Repository navigation
[security] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection #97612
Description
Activity
Example:
$ ./python Tools/scripts/get-remote-certificate.py 'localhost"||echo 1 > /tmp/marker #:80' (...) $ cat /tmp/marker 1- changed the title
[-][security][CVE-2022-37460] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection[/-][+][security] Tools/scripts/get-remote-certificate.py is vulnerable to shell code injection[/+]on Sep 28, 2022 I removed mention of CVE-2022-37460: it was withdrawn according to @gpshead.
- added a commit that references this issue
on Sep 28, 2022 - added 6 commits that reference this issue
on Sep 28, 2022 I created https://discuss.python.org/t/remove-outdated-tools-scripts-scripts/19571 discussion to propose removing outdated example scripts.
The
Tools/scripts/get-remote-certificate.pyscript is vulnerable to shell code injection. This vulnerability was reported by Caleb Shortt (@calebshortt).@calebshortt proposed PR #96014 to fix it.