[BUG] CVE patches for 2017.7.8 contain code from newer version and doesn't work
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
After applying the next CVE patches
https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/01/28/2017.7.8.patch
https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2021/02/05/2017.7.8.patch
salt 2017.7.8 stop working properly
The last patch contains the next bug:
call of if daemonize and not salt.utils.platform.is_windows():
failed with next error:
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/salt/utils/process.py", line 663, in _run
return self._original_run()
File "/usr/lib/python2.7/multiprocessing/process.py", line 114, in run
self._target(*self._args, **self._kwargs)
File "/usr/lib/python2.7/dist-packages/salt/client/mixins.py", line 477, in _proc_function
if daemonize and not salt.utils.platform.is_windows():
AttributeError: 'module' object has no attribute 'platform'
Seems here should be used if daemonize and not salt.utils.is_windows():
Also seems salt.utils.process.daemonize() valid only for newest salt versions
Please review CVE patches for 2017.7.8 and fix issues.
Thanks
Steps to Reproduce the behavior
Use above function
Expected behavior
All works fine
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 2017.7.8
Dependency Versions:
cffi: 1.9.1
cherrypy: 3.5.0
dateutil: 2.4.2
docker-py: 1.9.0
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.8
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: 0.21.1
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.4.6
mysql-python: Not Installed
pycparser: 2.14
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: Not Installed
Python: 2.7.12 (default, Nov 12 2018, 14:36:49)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.2.0
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.1.4
System Versions:
dist: Ubuntu 16.04 xenial
locale: UTF-8
machine: x86_64
release: 4.15.0-43-generic
system: Linux
version: Ubuntu 16.04 xenial
Additional context
Add any other context about the problem here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the referenced 2017.7.8 CVE patches with salt/client/mixins.py and salt/utils/process.py, focusing on the traceback locations and the platform and daemonize calls. Reproduce the failure on Salt 2017.7.8 with the patches applied, then verify that the patched release operates correctly without the reported AttributeError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100