Bug 49640 – sql injection in remove_ad_rejected.py

Bug 49640 - sql injection in remove_ad_rejected.py


Summary:	sql injection in remove_ad_rejected.py

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	AD Connector
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.4-1-errata
Assigned To:	Julia Bremer
QA Contact:	Florian Best

URL:
Keywords:

Depends on:	49445
Blocks:
	Show dependency tree / graph

Reported:	2019-06-13 13:19 CEST by Florian Best
Modified:	2019-07-31 13:58 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Florian Best

2019-06-13 13:19:12 CEST

The same applies to the AD-Connector scripts.

+++ This bug was initially created as a clone of Bug #49445 +++

root@master100:/usr/share/univention-s4-connector# ./remove_s4_rejected.py 'OU=ôscŵ\?ê\3Dô\<4,OU=öGF!*'"'"')%%ẑ,DC=school,DC=dev'
Traceback (most recent call last):
  File "./remove_s4_rejected.py", line 66, in <module>
    remove_s4_rejected(s4_dn)
  File "./remove_s4_rejected.py", line 46, in remove_s4_rejected
    c.execute("SELECT key FROM 'S4 rejected' WHERE value='%s'" % s4_dn)
sqlite3.OperationalError: near ")": syntax error

Comment 1 Julia Bremer

2019-07-25 14:26:21 CEST

12364a645f Bug #49640: yaml
90e35808e2 Bug #49640: fix sql evaluation in remove_{ucs,ad}_rejected.py

Successful build
Package: univention-ad-connector
Version: 13.0.0-10A~4.4.0.201907251417
Branch: ucs_4.4-0
Scope: errata4.4-1
User: jbremer

Comment 2 Florian Best

2019-07-25 16:17:40 CEST

OK: Scripts
OK: YAML

Comment 3 Arvid Requate

2019-07-31 13:58:40 CEST

<http://errata.software-univention.de/ucs/4.4/199.html>