[security] Injecting environment variable in subprocess on Windows

[serhiy-storchaka]

BPO	30730
Nosy	@birkenfeld, @pfmoore, @vstinner, @larryhastings, @tjguk, @benjaminp, @ned-deily, @zware, @serhiy-storchaka, @zooba
PRs	bpo-30730: Prevent environment variables injection in subprocess on Windows. #2325 [3.6] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) #2360 [3.5] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) #2361 [security][3.4] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) #2362 [security][3.3] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) #2363 [2.7] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) #2372 bpo-30745: Fix compiler warnings introduced in bpo-30730. #2376 [3.6] bpo-30745: Fix compiler warnings introduced in bpo-30730. (GH-2376) #2378 [3.5] bpo-30745: Fix compiler warnings introduced in bpo-30730. (GH-2376) #2379

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2017-07-19.05:17:56.399>
created_at = <Date 2017-06-22.08:07:00.032>
labels = ['type-security', 'extension-modules', '3.7', 'release-blocker']
title = '[security] Injecting environment variable in subprocess on Windows'
updated_at = <Date 2019-05-10.18:17:07.168>
user = 'https://github.com/serhiy-storchaka'

bugs.python.org fields:

activity = <Date 2019-05-10.18:17:07.168>
actor = 'ned.deily'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2017-07-19.05:17:56.399>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2017-06-22.08:07:00.032>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 30730
keywords = []
message_count = 23.0
messages = ['296618', '296725', '296728', '296729', '296753', '296760', '296767', '296769', '296772', '297175', '297449', '297468', '297472', '297936', '298145', '298146', '298147', '298148', '298151', '298218', '298222', '298628', '298865']
nosy_count = 10.0
nosy_names = ['georg.brandl', 'paul.moore', 'vstinner', 'larry', 'tim.golden', 'benjamin.peterson', 'ned.deily', 'zach.ware', 'serhiy.storchaka', 'steve.dower']
pr_nums = ['2325', '2360', '2361', '2362', '2363', '2372', '2376', '2378', '2379']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue30730'
versions = ['Python 2.7', 'Python 3.3', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7']

[serhiy-storchaka]

It is possible to inject an environment variable in subprocess on Windows if a user data is passed to a subprocess via environment variable.

Provided PR fixes this vulnerability. It also adds other checks for invalid environment (variable names containing '=') and command arguments (containing '\0').

This was a part of bpo-13617, but extracted to a separate issue due to increased severity.

[serhiy-storchaka]

New changeset d174d24 by Serhiy Storchaka in branch 'master':
bpo-30730: Prevent environment variables injection in subprocess on Windows. (bpo-2325)
d174d24

[serhiy-storchaka]

New changeset e713575 by Serhiy Storchaka in branch '3.6':
[3.6] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) (bpo-2360)
e713575

[serhiy-storchaka]

New changeset a7c0264 by Serhiy Storchaka in branch '3.5':
[3.5] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) (bpo-2361)
a7c0264

[serhiy-storchaka]

3.3 and 3.4 starves from this issue

[serhiy-storchaka]

New changeset 9dda2ca by Serhiy Storchaka in branch '2.7':
[2.7] bpo-30730: Prevent environment variables injection in subprocess on Windows. (GH-2325) (bpo-2372)
9dda2ca

[serhiy-storchaka]

New changeset 0ee32c1 by Serhiy Storchaka in branch 'master':
bpo-30745: Fix compiler warnings introduced in bpo-30730. (bpo-2376)
0ee32c1

[serhiy-storchaka]

New changeset 0e1f9e8 by Serhiy Storchaka in branch '3.6':
[3.6] bpo-30745: Fix compiler warnings introduced in bpo-30730. (GH-2376) (bpo-2378)
0e1f9e8

[serhiy-storchaka]

New changeset e0d446e by Serhiy Storchaka in branch '3.5':
[3.5] bpo-30745: Fix compiler warnings introduced in bpo-30730. (GH-2376) (bpo-2379)
e0d446e

[serhiy-storchaka]

Isn't "Type: security" enough? If you want you could patch Roundup for highlighting security issues.