Branch: refs/heads/master
Home:
https://github.com/tribe29/checkmk
Commit: 844deb26f802120b4736bdb73348e3ccb2833a28
https://github.com/tribe29/checkmk/commit/844deb26f802120b4736bdb73348e3ccb…
Author: Hannes Rantzsch <hannes.rantzsch(a)tribe29.com>
Date: 2022-07-11 (Mon, 11 Jul 2022)
Changed paths:
M cmk/gui/watolib/hosts_and_folders.py
M cmk/utils/store/__init__.py
M cmk/utils/store/_file.py
M cmk/utils/store/_locks.py
M cmk/utils/store/host_storage.py
M tests/unit/cmk/utils/test_store.py
Log Message:
-----------
Restrict file permissions for ObjectStore loading
* Prevent ObjectStore from loading world-writable files to mitigate the
dangers of serializers that must not be used with untrusted files
(such as pickle).
* Fix leave_locked_unless_exception contextmanager to re-raise
exceptions.
* Move PickleSerializer closer to ObjectStore to discourage using it
without the above mitigations.
* Remove ObjectStore's unused interface to store files with permissions
other than 0o660.
Fixes CMK-10853.
Change-Id: I22b0c2d38517669c9d1422224f420667a6553985