saltstack / saltstack/salt

[BUG] CVE patches for 2017.7.8 contain code from newer version and doesn't work

Open
#60,011 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-critical
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
After applying the next CVE patches
https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/01/28/2017.7.8.patch
https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/02/05/2017.7.8.patch
salt 2017.7.8 stop working properly

The last patch contains the next bug:
call of if daemonize and not salt.utils.platform.is_windows():
failed with next error:

Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/salt/utils/process.py", line 663, in _run
return self._original_run()
File "/usr/lib/python2.7/multiprocessing/process.py", line 114, in run
self._target(*self._args, **self._kwargs)
File "/usr/lib/python2.7/dist-packages/salt/client/mixins.py", line 477, in _proc_function
if daemonize and not salt.utils.platform.is_windows():
AttributeError: 'module' object has no attribute 'platform'

Seems here should be used if daemonize and not salt.utils.is_windows():
Also seems salt.utils.process.daemonize() valid only for newest salt versions

Please review CVE patches for 2017.7.8 and fix issues.
Thanks

Steps to Reproduce the behavior
Use above function

Expected behavior
All works fine

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
           Salt: 2017.7.8
 
Dependency Versions:
           cffi: 1.9.1
       cherrypy: 3.5.0
       dateutil: 2.4.2
      docker-py: 1.9.0
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.8
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: 0.21.1
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: 2.14
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.12 (default, Nov 12 2018, 14:36:49)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 15.2.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.1.4
 
System Versions:
           dist: Ubuntu 16.04 xenial
         locale: UTF-8
        machine: x86_64
        release: 4.15.0-43-generic
         system: Linux
        version: Ubuntu 16.04 xenial

Additional context
Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the referenced 2017.7.8 CVE patches with salt/client/mixins.py and salt/utils/process.py, focusing on the traceback locations and the platform and daemonize calls. Reproduce the failure on Salt 2017.7.8 with the patches applied, then verify that the patched release operates correctly without the reported AttributeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.