From 7e3a4739f06c3fa15c7e75d0b152dcd536ff9576 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Tue, 15 May 2018 18:51:38 +0200 Subject: [PATCH 1/9] ssh(sec): fix newline problem on key saving that would allow bypassing command sandbox. --- rhodecode/apps/ssh_support/utils.py | 24 ++++++++++++------- .../users/user_edit_ssh_keys_generate.mako | 18 +++++++------- 2 files changed, 24 insertions(+), 18 deletions(-) diff --git a/rhodecode/apps/ssh_support/utils.py b/rhodecode/apps/ssh_support/utils.py index 0c192b7e..4cce26cd 100644 --- a/rhodecode/apps/ssh_support/utils.py +++ b/rhodecode/apps/ssh_support/utils.py @@ -84,16 +84,22 @@ def _generate_ssh_authorized_keys_file( for user_key in all_active_keys: username = user_key.user.username user_id = user_key.user.user_id + # replace all newline from ends and inside + safe_key_data = user_key.ssh_key_data\ + .strip()\ + .replace('\n', ' ')\ + .replace('\r', ' ') - keys_file.write( - line_tmpl.format( - ssh_opts=ssh_opts or SSH_OPTS, - wrapper_command=ssh_wrapper_cmd, - ini_path=ini_path, - user_id=user_id, - user=username, - user_key_id=user_key.ssh_key_id, - key=user_key.ssh_key_data)) + line = line_tmpl.format( + ssh_opts=ssh_opts or SSH_OPTS, + wrapper_command=ssh_wrapper_cmd, + ini_path=ini_path, + user_id=user_id, + user=username, + user_key_id=user_key.ssh_key_id, + key=safe_key_data) + + keys_file.write(line) log.debug('addkey: Key added for user: `%s`', username) keys_file.close() diff --git a/rhodecode/templates/admin/users/user_edit_ssh_keys_generate.mako b/rhodecode/templates/admin/users/user_edit_ssh_keys_generate.mako index e64bafdc..406565be 100644 --- a/rhodecode/templates/admin/users/user_edit_ssh_keys_generate.mako +++ b/rhodecode/templates/admin/users/user_edit_ssh_keys_generate.mako @@ -8,13 +8,13 @@

${_('Private key')}

-# Save the content as
-# Windows: /Users//.ssh/id_rsa_rhodecode_access_priv.key
-# macOS: /Users//.ssh/id_rsa_rhodecode_access_priv.key
-# Linux: /home//.ssh/id_rsa_rhodecode_access_priv.key
+# Save the below content as
+# Windows: /Users/{username}/.ssh/id_rsa_rhodecode_access_priv.key
+# macOS: /Users/{yourname}/.ssh/id_rsa_rhodecode_access_priv.key
+# Linux: /home/{username}/.ssh/id_rsa_rhodecode_access_priv.key
 
 # Change permissions to 0600 to make it secure, and usable.
-e.g chmod 0600 /home//.ssh/id_rsa_rhodecode_access_priv.key
+e.g chmod 0600 /home/{username}/.ssh/id_rsa_rhodecode_access_priv.key
@@ -24,10 +24,10 @@ e.g chmod 0600 /home//.ssh/id_rsa_rhodecode_access_priv.key

${_('Public key')}

-# Save the content as
-# Windows: /Users//.ssh/id_rsa_rhodecode_access_pub.key
-# macOS: /Users//.ssh/id_rsa_rhodecode_access_pub.key
-# Linux: /home//.ssh/id_rsa_rhodecode_access_pub.key
+# Save the below content as
+# Windows: /Users/{username}/.ssh/id_rsa_rhodecode_access_pub.key
+# macOS: /Users/{yourname}/.ssh/id_rsa_rhodecode_access_pub.key
+# Linux: /home/{username}/.ssh/id_rsa_rhodecode_access_pub.key
From 6ab28d6c968c886683da292e5a1c876369c7ae83 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Tue, 15 May 2018 19:44:10 +0200 Subject: [PATCH 2/9] docs: fixed some errors in release notes. --- docs/release-notes/release-notes-4.12.0.rst | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/release-notes/release-notes-4.12.0.rst b/docs/release-notes/release-notes-4.12.0.rst index 1632ad8e..b3a3aac8 100644 --- a/docs/release-notes/release-notes-4.12.0.rst +++ b/docs/release-notes/release-notes-4.12.0.rst @@ -32,7 +32,7 @@ New Features prevent problems when connection to LDAP is not stable causing RhodeCode instances to freeze waiting on LDAP connections. - User groups: expose public user group profiles. Allows to see members of a user - groups by other team members, if they have proper permissions. + group by other team members, if they have proper permissions. - UI: show pull request page in quick nav menu on my account for quicker access. - UI: hidden/outdated comments now have visible markers next to line numbers. This allows access to them without showing all hidden comments. @@ -99,7 +99,7 @@ Performance ^^^^^^^^^^^ - Diffs: don't use recurred diffset attachment in diffs. This makes -this structure much harder to garbage collect. Reduces memory usage. + this structure much harder to garbage collect. Reduces memory usage. - Diff cache: added caching for better performance of large pull requests. @@ -114,7 +114,7 @@ Fixes - Pull requests: fixed cases with default expected refs are closed or unavailable. For Mercurial with closed default branch a compare across forks could fail. - Core: properly report 502 errors for gevent and gunicorn. - Gevent wtih Gunicorn doesn't raise normal pycurl errors. + Gevent with Gunicorn doesn't raise normal pycurl errors. - Auth plugins: fixed problem with cache of settings in multi-worker mode. The previous implementation had a bug that cached the settings in each class, caused not refreshing the update of settings in multi-worker mode. @@ -130,14 +130,15 @@ Upgrade notes ^^^^^^^^^^^^^ - This release adds support for SVN hook. This required lots of changes on how we -handle SVN protocol. We did thoughtful tests for SVN compatibility. -Please be advised to check the behaviour of SVN repositories during this update. + handle SVN protocol. We did thoughtful tests for SVN compatibility. + Please be advised to check the behaviour of SVN repositories during this update. A check and migrate of SVN hooks is required. In order to do so, please execute `Rescan filesystem` from admin > settings > Remap and Rescan. This will migrate all SVN hook to latest available version. To migrate single repository only, please go to the following url: `your-rhodecode-server.com/REPO_NAME/settings/advanced/hooks` -- Diff caches are turned off by default for backward compatibility. We however recommend -turning them on either individually for bigger repositories or globally for every repository. -This setting can be found in admin > settings > vcs, or repository > settings > vcs +- Diff caches are turned off by default for backward compatibility. + We however recommend turning them on either individually for bigger + repositories or globally for every repository. + This setting can be found in admin > settings > vcs, or repository > settings > vcs From b5d6ed7f04c5801f7e396ea4f04c4ea4afdf2a40 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Tue, 15 May 2018 20:58:55 +0200 Subject: [PATCH 3/9] docs: added release notes for 4.12.2 --- docs/release-notes/release-notes-4.12.2.rst | 40 +++++++++++++++++++++ docs/release-notes/release-notes.rst | 1 + 2 files changed, 41 insertions(+) create mode 100644 docs/release-notes/release-notes-4.12.2.rst diff --git a/docs/release-notes/release-notes-4.12.2.rst b/docs/release-notes/release-notes-4.12.2.rst new file mode 100644 index 00000000..771c296c --- /dev/null +++ b/docs/release-notes/release-notes-4.12.2.rst @@ -0,0 +1,40 @@ +|RCE| 4.12.2 |RNS| +------------------ + +Release Date +^^^^^^^^^^^^ + +- 2018-05-16 + + +New Features +^^^^^^^^^^^^ + + + +General +^^^^^^^ + + + +Security +^^^^^^^^ + +- SSH: fixed found problem with key-storage that could allow remote logins + performed by rhodecode authorized users with specially crafted SSH Keys. + + +Performance +^^^^^^^^^^^ + + + +Fixes +^^^^^ + + + +Upgrade notes +^^^^^^^^^^^^^ + +- Scheduled release addressing found problems reported by users. diff --git a/docs/release-notes/release-notes.rst b/docs/release-notes/release-notes.rst index 3226809f..353f1b00 100644 --- a/docs/release-notes/release-notes.rst +++ b/docs/release-notes/release-notes.rst @@ -9,6 +9,7 @@ Release Notes .. toctree:: :maxdepth: 1 + release-notes-4.12.2.rst release-notes-4.12.1.rst release-notes-4.12.0.rst release-notes-4.11.6.rst From 10cf433145f481df234f0916bc362dce35654cc8 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Wed, 16 May 2018 23:01:46 +0200 Subject: [PATCH 4/9] ssh-keys: further sanitize data of inputted SSH keys. --- rhodecode/apps/admin/views/users.py | 2 +- rhodecode/apps/my_account/views/my_account_ssh_keys.py | 2 +- rhodecode/apps/ssh_support/utils.py | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/rhodecode/apps/admin/views/users.py b/rhodecode/apps/admin/views/users.py index 2de12237..ff0891cc 100644 --- a/rhodecode/apps/admin/views/users.py +++ b/rhodecode/apps/admin/views/users.py @@ -826,7 +826,7 @@ class UsersView(UserAppView): fingerprint = key.hash_md5() ssh_key = SshKeyModel().create( - c.user.user_id, fingerprint, key_data, description) + c.user.user_id, fingerprint, key.keydata, description) ssh_key_data = ssh_key.get_api_data() audit_logger.store_web( diff --git a/rhodecode/apps/my_account/views/my_account_ssh_keys.py b/rhodecode/apps/my_account/views/my_account_ssh_keys.py index 78036171..70865d51 100644 --- a/rhodecode/apps/my_account/views/my_account_ssh_keys.py +++ b/rhodecode/apps/my_account/views/my_account_ssh_keys.py @@ -98,7 +98,7 @@ class MyAccountSshKeysView(BaseAppView, DataGridAppView): fingerprint = key.hash_md5() ssh_key = SshKeyModel().create( - c.user.user_id, fingerprint, key_data, description) + c.user.user_id, fingerprint, key.keydata, description) ssh_key_data = ssh_key.get_api_data() audit_logger.store_web( diff --git a/rhodecode/apps/ssh_support/utils.py b/rhodecode/apps/ssh_support/utils.py index 4cce26cd..5b2129e0 100644 --- a/rhodecode/apps/ssh_support/utils.py +++ b/rhodecode/apps/ssh_support/utils.py @@ -87,7 +87,8 @@ def _generate_ssh_authorized_keys_file( # replace all newline from ends and inside safe_key_data = user_key.ssh_key_data\ .strip()\ - .replace('\n', ' ')\ + .replace('\n', ' ') \ + .replace('\t', ' ') \ .replace('\r', ' ') line = line_tmpl.format( From 2e839dea155420198feed78cbcf90bbfd4410693 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Wed, 16 May 2018 23:51:06 +0200 Subject: [PATCH 5/9] docs: update on 4.12.2 release notes --- docs/release-notes/release-notes-4.12.2.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/release-notes/release-notes-4.12.2.rst b/docs/release-notes/release-notes-4.12.2.rst index 771c296c..f5848cc3 100644 --- a/docs/release-notes/release-notes-4.12.2.rst +++ b/docs/release-notes/release-notes-4.12.2.rst @@ -15,6 +15,7 @@ New Features General ^^^^^^^ +- Jenkins: further improve handling of proxied Jenkins server. Security @@ -37,4 +38,4 @@ Fixes Upgrade notes ^^^^^^^^^^^^^ -- Scheduled release addressing found problems reported by users. +- Unscheduled release addressing found security problem. From fe0b0f086641c9cee08b47422d81f17671be0f39 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Thu, 17 May 2018 00:25:11 +0200 Subject: [PATCH 6/9] release: Update the generated API documentation --- .bumpversion.cfg | 2 +- .release.cfg | 8 ++------ rhodecode/VERSION | 2 +- 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/.bumpversion.cfg b/.bumpversion.cfg index 7cfa2e6c..1ae765d1 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 4.12.1 +current_version = 4.12.2 message = release: Bump version {current_version} to {new_version} [bumpversion:file:rhodecode/VERSION] diff --git a/.release.cfg b/.release.cfg index e1929ad2..725bc9eb 100644 --- a/.release.cfg +++ b/.release.cfg @@ -5,23 +5,19 @@ done = false done = true [task:rc_tools_pinned] -done = true [task:fixes_on_stable] -done = true [task:pip2nix_generated] -done = true [task:changelog_updated] -done = true [task:generate_api_docs] done = true [release] -state = prepared -version = 4.12.1 +state = in_progress +version = 4.12.2 [task:updated_translation] diff --git a/rhodecode/VERSION b/rhodecode/VERSION index 2efddba7..ea64bf68 100644 --- a/rhodecode/VERSION +++ b/rhodecode/VERSION @@ -1 +1 @@ -4.12.1 \ No newline at end of file +4.12.2 \ No newline at end of file From 5424621554496795cf6ab115cbe81c7731699a0c Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Thu, 17 May 2018 00:32:20 +0200 Subject: [PATCH 7/9] release: updated pip2nix output for 4.12.2 --- .release.cfg | 3 +++ pkgs/python-packages.nix | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.release.cfg b/.release.cfg index 725bc9eb..acf54457 100644 --- a/.release.cfg +++ b/.release.cfg @@ -5,12 +5,15 @@ done = false done = true [task:rc_tools_pinned] +done = true [task:fixes_on_stable] +done = true [task:pip2nix_generated] [task:changelog_updated] +done = true [task:generate_api_docs] done = true diff --git a/pkgs/python-packages.nix b/pkgs/python-packages.nix index 298d4810..5dc061be 100644 --- a/pkgs/python-packages.nix +++ b/pkgs/python-packages.nix @@ -1667,7 +1667,7 @@ }; }; rhodecode-enterprise-ce = super.buildPythonPackage { - name = "rhodecode-enterprise-ce-4.12.1"; + name = "rhodecode-enterprise-ce-4.12.2"; buildInputs = with self; [pytest py pytest-cov pytest-sugar pytest-runner pytest-catchlog pytest-profiling gprof2dot pytest-timeout mock WebTest cov-core coverage configobj]; doCheck = true; propagatedBuildInputs = with self; [setuptools-scm amqp authomatic Babel Beaker celery Chameleon channelstream click colander configobj cssselect decorator deform docutils dogpile.cache dogpile.core ecdsa FormEncode future futures gnureadline infrae.cache iso8601 itsdangerous Jinja2 billiard kombu lxml Mako Markdown MarkupSafe msgpack-python MySQL-python objgraph packaging Paste PasteDeploy PasteScript pathlib2 peppercorn psutil psycopg2 py-bcrypt pycrypto pycurl pyflakes pygments-markdown-lexer Pygments pyparsing pyramid-beaker pyramid-debugtoolbar pyramid-jinja2 pyramid-mako pyramid pysqlite python-dateutil python-ldap python-memcached python-pam pytz tzlocal pyzmq py-gfm redis repoze.lru requests Routes setproctitle simplejson six SQLAlchemy sshpubkeys subprocess32 supervisor Tempita translationstring trollius urllib3 URLObject venusian WebError WebHelpers2 WebHelpers WebOb Whoosh wsgiref zope.cachedescriptors zope.deprecation zope.event zope.interface nbconvert bleach nbformat jupyter-client alembic invoke bumpversion transifex-client gevent greenlet gunicorn waitress uWSGI ipdb ipython CProfileV bottle rhodecode-tools appenlight-client pytest py pytest-cov pytest-sugar pytest-runner pytest-catchlog pytest-profiling gprof2dot pytest-timeout mock WebTest cov-core coverage]; From dff1878a6bd327c346efeb3a59f7268dc7cfcb46 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Thu, 17 May 2018 00:32:22 +0200 Subject: [PATCH 8/9] release: Finish preparation for 4.12.2 --- .release.cfg | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.release.cfg b/.release.cfg index acf54457..ba549542 100644 --- a/.release.cfg +++ b/.release.cfg @@ -11,6 +11,7 @@ done = true done = true [task:pip2nix_generated] +done = true [task:changelog_updated] done = true @@ -19,7 +20,7 @@ done = true done = true [release] -state = in_progress +state = prepared version = 4.12.2 [task:updated_translation] From e7d6565b4f210495ef162a18da05216d97f21629 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Thu, 17 May 2018 00:32:22 +0200 Subject: [PATCH 9/9] Added tag v4.12.2 for changeset 6a517543ea9e