{"action":"created","issue":{"url":"https://api.github.com/repos/pulp/pulp/issues/2532","repository_url":"https://api.github.com/repos/pulp/pulp","labels_url":"https://api.github.com/repos/pulp/pulp/issues/2532/labels{/name}","comments_url":"https://api.github.com/repos/pulp/pulp/issues/2532/comments","events_url":"https://api.github.com/repos/pulp/pulp/issues/2532/events","html_url":"https://github.com/pulp/pulp/pull/2532","id":148123544,"number":2532,"title":"Safely create the dir in which the CA is created (CVE-2016-3106).","user":{"login":"rbarlow","id":354506,"avatar_url":"https://avatars.githubusercontent.com/u/354506?v=3","gravatar_id":"","url":"https://api.github.com/users/rbarlow","html_url":"https://github.com/rbarlow","followers_url":"https://api.github.com/users/rbarlow/followers","following_url":"https://api.github.com/users/rbarlow/following{/other_user}","gists_url":"https://api.github.com/users/rbarlow/gists{/gist_id}","starred_url":"https://api.github.com/users/rbarlow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rbarlow/subscriptions","organizations_url":"https://api.github.com/users/rbarlow/orgs","repos_url":"https://api.github.com/users/rbarlow/repos","events_url":"https://api.github.com/users/rbarlow/events{/privacy}","received_events_url":"https://api.github.com/users/rbarlow/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pulp/pulp/labels/bugfix","name":"bugfix","color":"fc2929"},{"url":"https://api.github.com/repos/pulp/pulp/labels/LGTM","name":"LGTM","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-13T17:06:21Z","updated_at":"2016-04-14T19:06:55Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pulp/pulp/pulls/2532","html_url":"https://github.com/pulp/pulp/pull/2532","diff_url":"https://github.com/pulp/pulp/pull/2532.diff","patch_url":"https://github.com/pulp/pulp/pull/2532.patch"},"body":"Prior to this commit, the pulp-gen-ca-certificate script created\r\nthe Pulp CA certificate and key in /tmp/$RANDOM. This led to about\r\n32,768 possible directories. Florian Weimer and Sander Bos\r\nnotified the Pulp team that if a user happened to own a directory\r\nthat the script chose, the user would be able to read the\r\ncertificate authority certificate. Additionally, both security\r\nresearchers concluded that there is a race condition between\r\ncreating the secure folder and the later chmod, during which an\r\nattacker could read and hold open the inode for the $TMP\r\ndirectory. This would allow an attacker to read the key that is\r\nlater written.\r\n\r\nSander Bos additionally concluded that an attacker could create a\r\nDoS attack two ways: 0) By creating a symlink within the $TMP\r\ndirectory that points at an important system resource, such as\r\n/etc/passwd, or 1) By creating $TMP itself as a symlink to /,\r\nwhich would cause / to be chmod'd to 0700 later in the script.\r\n\r\nThis commit adjusts the script to use mktemp -d to ensure that a\r\nunique and safe directory is used to create the Pulp CA\r\ncertificate. Additionally, the script uses set -e so that it will\r\nhalt if there are errors.\r\n\r\nThanks to Florian Weimer and to Sander Bos for independently\r\nnotifying Pulp of the issue and for suggesting the needed changes\r\nto fix it. Thanks to Adam Mariš for advising the Pulp team through\r\nthe fix. The Pulp team is thankful to the security community for\r\ntheir thoughtful analysis, and for taking the time to report these\r\nissues.\r\n\r\nhttps://pulp.plan.io/issues/1827\r\n\r\nfixes #1827"},"comment":{"url":"https://api.github.com/repos/pulp/pulp/issues/comments/210103308","html_url":"https://github.com/pulp/pulp/pull/2532#issuecomment-210103308","issue_url":"https://api.github.com/repos/pulp/pulp/issues/2532","id":210103308,"user":{"login":"seandst","id":441252,"avatar_url":"https://avatars.githubusercontent.com/u/441252?v=3","gravatar_id":"","url":"https://api.github.com/users/seandst","html_url":"https://github.com/seandst","followers_url":"https://api.github.com/users/seandst/followers","following_url":"https://api.github.com/users/seandst/following{/other_user}","gists_url":"https://api.github.com/users/seandst/gists{/gist_id}","starred_url":"https://api.github.com/users/seandst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seandst/subscriptions","organizations_url":"https://api.github.com/users/seandst/orgs","repos_url":"https://api.github.com/users/seandst/repos","events_url":"https://api.github.com/users/seandst/events{/privacy}","received_events_url":"https://api.github.com/users/seandst/received_events","type":"User","site_admin":false},"created_at":"2016-04-14T19:06:55Z","updated_at":"2016-04-14T19:06:55Z","body":"ok test"}}