mirror of
https://git.proxmox.com/git/pve-manager
synced 2025-11-03 08:29:01 +00:00
c92fc8a1e8
We get the device list from ceph-volume lvm list, and decode the json
output, which at that point is tainted (perlsec (1)).
Untaint it here before calling, because it is currently the only
call-site using the information in a problematic way (run_command).
(the only other call-site being in pve5to6)
Alternatively we could untaint while reading the information, but then
should only return a small subset of the ceph-volume output.
The issue is most likely due to
cb9db10c1a9855cf40ff13e81f9dd97d6a9b2698 in pve-common ('run_command:
improve performance for logging and long lines'),
Tested on a virtual testsetup by creating OSDs with second DB disk,
and destroying it via GUI (did not manage to get the error without the
DB disk)
Reported via our community forum:
https://forum.proxmox.com/threads/insecure-dependency-in-exec-during-osd-destroy.79574/
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
|
||
|---|---|---|
| .. | ||
| Ceph | ||
| Cluster | ||
| Hardware | ||
| ACME.pm | ||
| ACMEAccount.pm | ||
| ACMEPlugin.pm | ||
| APT.pm | ||
| Backup.pm | ||
| BackupInfo.pm | ||
| Ceph.pm | ||
| Certificates.pm | ||
| Cluster.pm | ||
| HAConfig.pm | ||
| Hardware.pm | ||
| Makefile | ||
| Network.pm | ||
| NodeConfig.pm | ||
| Nodes.pm | ||
| Pool.pm | ||
| Replication.pm | ||
| ReplicationConfig.pm | ||
| Scan.pm | ||
| Services.pm | ||
| Subscription.pm | ||
| Tasks.pm | ||
| VZDump.pm | ||