[MDEV-23884] donor uses invalid SST methods Created: 2020-10-03 Updated: 2023-10-18 Resolved: 2020-10-07 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Galera SST |
| Affects Version/s: | 10.1, 10.2, 10.3, 10.4, 10.5 |
| Fix Version/s: | 10.1.47, 10.2.34, 10.3.25, 10.4.15, 10.5.6 |
| Type: | Bug | Priority: | Blocker |
| Reporter: | Sergei Golubchik | Assignee: | Sergei Golubchik |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||
| Description |
|
during SST a joiner sends an sst method name to the donor. Donor then appends it to the "wsrep_sst_" string to get the name of the sst script to use, e.g. wsrep_sst_rsync. There is no validation or filtering here, so if the malicious joiner sends, for example, "rsync `rm -rf /`" the donor will execute that too. |
| Comments |
| Comment by Sergei Golubchik [ 2020-10-31 ] |
|
CVE-2020-15180 |