)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"change_message_id":"106fc8a47518730bb6aff99719d1f8662f9fd2fe","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Change-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581"},{"line_number":22,"context_line":"Signed-off-by: Andreas Fritiofson \u003candreas.fritiofson@gmail.com\u003e"},{"line_number":23,"context_line":"Found-by: Josef Gajdusek \u003catx@atx.name\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"2e489777_975a1421","line":23,"range":{"start_line":23,"start_character":0,"end_line":23,"end_character":8},"updated":"2018-01-15 17:21:53.000000000","message":"Reported-by seems more standard.","commit_id":"98a97899e50c4e2b933636c2661afc169032ceb7"}],"src/server/startup.tcl":[{"author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"change_message_id":"b2bde519ef38de2cfbcb929604c41dfda68d58fb","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\techo \"It looks like somebody is sending POST or Host: commands to OpenOCD.\""},{"line_number":15,"context_line":"\techo \"This is likely due to an attacker attempting to use Cross Protocol Scripting\""},{"line_number":16,"context_line":"\techo \"to compromise your OpenOCD instance. Connection aborted.\""},{"line_number":17,"context_line":"\texit"},{"line_number":18,"context_line":"}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"proc POST {args} { prevent_cps }"}],"source_content_type":"text/x-tcl","patch_set":1,"id":"2e489777_57a49c04","line":17,"updated":"2018-01-15 18:43:37.000000000","message":"IIUC this terminates the OpenOCD process. That effectively turns an arbitrary execution vulnerability into a denial of service vulnerability. Can\u0027t you just close the current connection while leaving the server process running?","commit_id":"98a97899e50c4e2b933636c2661afc169032ceb7"},{"author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"change_message_id":"14d8f4a17849fc1600333f902ba1fb17d8de154f","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\techo \"It looks like somebody is sending POST or Host: commands to OpenOCD.\""},{"line_number":15,"context_line":"\techo \"This is likely due to an attacker attempting to use Cross Protocol Scripting\""},{"line_number":16,"context_line":"\techo \"to compromise your OpenOCD instance. Connection aborted.\""},{"line_number":17,"context_line":"\texit"},{"line_number":18,"context_line":"}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"proc POST {args} { prevent_cps }"}],"source_content_type":"text/x-tcl","patch_set":1,"id":"2e489777_d7af6cdd","line":17,"in_reply_to":"2e489777_17ae24e5","updated":"2018-01-15 18:58:03.000000000","message":"Sounds better. Need to test then.","commit_id":"98a97899e50c4e2b933636c2661afc169032ceb7"},{"author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"change_message_id":"b6bdf0f118e3e294f32725bb8af3ee71b77ab734","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\techo \"It looks like somebody is sending POST or Host: commands to OpenOCD.\""},{"line_number":15,"context_line":"\techo \"This is likely due to an attacker attempting to use Cross Protocol Scripting\""},{"line_number":16,"context_line":"\techo \"to compromise your OpenOCD instance. Connection aborted.\""},{"line_number":17,"context_line":"\texit"},{"line_number":18,"context_line":"}"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"proc POST {args} { prevent_cps }"}],"source_content_type":"text/x-tcl","patch_set":1,"id":"2e489777_17ae24e5","line":17,"in_reply_to":"2e489777_57a49c04","updated":"2018-01-15 18:54:08.000000000","message":"Andreas, I guess you\u0027re thinking about \"shutdown\" which indeed terminates the openocd process. \"exit\" here should just drop the telnet connection essentially.","commit_id":"98a97899e50c4e2b933636c2661afc169032ceb7"}]}