mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-16 04:17:25 +00:00
Gyorgy Sarvari
4c60a2c8d6
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67738 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
From 21d9cbdc2b719e9d1349f14e03b5a041b476cce5 Mon Sep 17 00:00:00 2001
|
|
From: Jamie Cameron <jcameron@webmin.com>
|
|
Date: Wed, 29 Oct 2025 22:02:29 -0700
|
|
Subject: [PATCH] Fix quoting of args
|
|
|
|
CVE: CVE-2025-67738
|
|
Upstream-Status: Backport [https://github.com/webmin/webmin/commit/1a52bf4d72f9da6d79250c66e51f41c6f5b880ee]
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
squid/cachemgr.cgi | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/squid/cachemgr.cgi b/squid/cachemgr.cgi
|
|
index b75f9427..41386d35 100755
|
|
--- a/squid/cachemgr.cgi
|
|
+++ b/squid/cachemgr.cgi
|
|
@@ -12,6 +12,7 @@ my ($mgr) = glob($config{'cachemgr_path'});
|
|
if (&has_command($mgr)) {
|
|
$| = 1;
|
|
my $temp;
|
|
+ my $args = join(" ", map { quotemeta($_) } @ARGV);
|
|
if ($ENV{'REQUEST_METHOD'} eq 'POST') {
|
|
# Deal with POST data
|
|
my $post;
|
|
@@ -21,10 +22,10 @@ if (&has_command($mgr)) {
|
|
&open_tempfile($fh, ">$temp", 0, 1);
|
|
&print_tempfile($fh, $post);
|
|
&close_tempfile($fh);
|
|
- open(MGR, "$mgr ".join(" ", @ARGV)." <$temp |");
|
|
+ open(MGR, "$mgr $args <$temp |");
|
|
}
|
|
else {
|
|
- open(MGR, "$mgr ".join(" ", @ARGV)." |");
|
|
+ open(MGR, "$mgr $args |");
|
|
}
|
|
while(<MGR>) {
|
|
print;
|