diff options
| author | Daniil Baturin <daniil@vyos.io> | 2026-09-08 12:33:08 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-08 12:33:08 +0100 |
| commit | e152d756fdd9d43c31e3ce3a79c64370f2df9615 (patch) | |
| tree | 87ff653360f3f0cf437a8d34547a1da8779e82cc /src/system | |
| parent | b0fb31d32f05691ed568b29a71d7963cb28aa053 (diff) | |
| parent | 0d4fd05058a855eef627a65f2b005a7c557ae022 (diff) | |
| download | vyos-1x-e152d756fdd9d43c31e3ce3a79c64370f2df9615.tar.gz vyos-1x-e152d756fdd9d43c31e3ce3a79c64370f2df9615.zip | |
Merge pull request #5450 from vyos/T8497-vyos-system-update-check-vulnarability
update-checker: T8497: fix command injection via crafted update server response
Diffstat (limited to 'src/system')
| -rwxr-xr-x | src/system/vyos-system-update-check.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/system/vyos-system-update-check.py b/src/system/vyos-system-update-check.py index b7d1fc7c5..b1b6e138c 100755 --- a/src/system/vyos-system-update-check.py +++ b/src/system/vyos-system-update-check.py @@ -59,7 +59,7 @@ if __name__ == '__main__': url = jmespath.search('[0].url', remote_data) remote_version = jmespath.search('[0].version', remote_data) if local_version != remote_version and remote_version: - call(f'wall -n "Update available: {remote_version} \nUpdate URL: {url}"') + call(['wall', '-n', f"Update available: {remote_version} \nUpdate URL: {url}"]) # MOTD used in /run/motd.d/10-vyos-update motd_file.parent.mkdir(exist_ok=True) motd_file.write_text(f'---\n' |