From 9698284cbe5a8515b453a58859e4c61f1a910337 Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Tue, 14 Apr 2026 17:49:38 +0300 Subject: T8497: vyos-system-update-check: fix vulnarability vyos-system-update-check.py was using data from untrusted source to pass to shell without escaping. Change to list in call to `call` to fix this. --- src/system/vyos-system-update-check.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/system/vyos-system-update-check.py b/src/system/vyos-system-update-check.py index b7d1fc7c5..b1b6e138c 100755 --- a/src/system/vyos-system-update-check.py +++ b/src/system/vyos-system-update-check.py @@ -59,7 +59,7 @@ if __name__ == '__main__': url = jmespath.search('[0].url', remote_data) remote_version = jmespath.search('[0].version', remote_data) if local_version != remote_version and remote_version: - call(f'wall -n "Update available: {remote_version} \nUpdate URL: {url}"') + call(['wall', '-n', f"Update available: {remote_version} \nUpdate URL: {url}"]) # MOTD used in /run/motd.d/10-vyos-update motd_file.parent.mkdir(exist_ok=True) motd_file.write_text(f'---\n' -- cgit v1.2.3 From 0d4fd05058a855eef627a65f2b005a7c557ae022 Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Thu, 16 Apr 2026 22:30:29 +0300 Subject: T8497: image_installer: fix vulnarability image_installer.py was using data from untrusted source to pass to shell without escaping in case VRF was activated. Change to list in call to `cmd` to fix this, remove extra code for VRF wrappers to library parameters. --- src/op_mode/image_installer.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'src') diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py index fb28f182e..b325df9bd 100755 --- a/src/op_mode/image_installer.py +++ b/src/op_mode/image_installer.py @@ -737,10 +737,7 @@ def image_fetch(image_path: str, vrf: str = None, # Latest version gets url from configured "system update-check url" if image_path == 'latest': - command = external_latest_image_url_script - if vrf: - command = f'ip vrf exec {vrf} {command}' - code, output = rc_cmd(command, env=environ) + code, output = rc_cmd(external_latest_image_url_script, vrf=vrf, env=environ) if code: print(output) exit(MSG_INFO_INSTALL_EXIT) -- cgit v1.2.3