[checkmk-commits] [tribe29/checkmk] 9e1004: Switch bin_dir from str to Path object

Branch: refs/heads/master Home: https://github.com/tribe29/checkmk Commit: 9e10043527e1e5d8b3cfd5ffc07d99c13c1a761a https://github.com/tribe29/checkmk/commit/9e10043527e1e5d8b3cfd5ffc07d99c13… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2022-04-14 (Thu, 14 Apr 2022) Changed paths: M cmk/utils/paths.py M tests/unit/cmk/utils/test_paths.py Log Message: ----------- Switch bin_dir from str to Path object Change-Id: I9c8624d558d5bc487a7a2b475d06298b93df9b64 Commit: 693535c45ddbe6330f61efed76521e0b46ef9e6a https://github.com/tribe29/checkmk/commit/693535c45ddbe6330f61efed76521e0b4… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2022-04-14 (Thu, 14 Apr 2022) Changed paths: A .werks/13897 M cmk/base/notify.py Log Message: ----------- Fix command injection vulnerability Previously to this Werk an attacker who could control certain notification variables such as <tt>NOTIFICATIONTYPE</tt> or <tt>HOSTNAME</tt> was able to inject commands to the fall-back mail command. The commands were then executed as site user. With this werk the variable <tt>MAIL_COMMAND</tt> is no longer available in notification scripts. You can reduce the risk of exploitation with disabling the listening of the notification spooler (the default is disabled) (CEE/CME only feature). All maintained versions (>=1.6) are subject to this vulnerability. It is likely that also previous versions were vulnerable. To detect possible exploitation <tt>var/log/mknotifyd.log</tt> and <tt>var/log/notify.log</tt> can be checked for special shell characters like <tt>&&</tt> and odd quoting. CMK-8780 Change-Id: I98236d1aa7854773862aee6fedcd669b09ba5fc0 Compare: https://github.com/tribe29/checkmk/compare/fff03407ea47...693535c45ddb