)]}'
{"id":"openocd~master~Ia96ebe19b74b5805dc228bf7364c7971a90a4581","project":"openocd","branch":"master","hashtags":[],"change_id":"Ia96ebe19b74b5805dc228bf7364c7971a90a4581","subject":"CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks","status":"MERGED","created":"2018-01-13 20:02:20.000000000","updated":"2019-11-22 18:25:34.000000000","submitted":"2019-11-22 18:25:34.000000000","submitter":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"total_comment_count":4,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"4335-1574447134313-793c5777","meta_rev_id":"5928a04474242e248793576893bab860be0257ed","_number":4335,"owner":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},{"value":0,"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},{"value":0,"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},{"value":1,"date":"2019-11-22 18:25:34.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},{"value":0,"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"}],"values":{"-1":"Fails"," 0":"No score","+1":"Verified"},"description":"","default_value":0},"Code-Review":{"approved":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"all":[{"value":2,"date":"2019-11-22 18:25:34.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},{"value":1,"date":"2019-11-22 18:25:34.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},{"value":0,"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},{"value":0,"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},{"value":0,"date":"2019-11-22 18:25:34.000000000","permitted_voting_range":{"min":0,"max":1},"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"}],"values":{"-2":"This shall not be merged","-1":"I would prefer this is not merged as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},{"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"},{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2018-01-15 18:58:03.000000000","updated_by":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"reviewer":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"state":"REVIEWER"},{"updated":"2018-01-16 07:48:10.000000000","updated_by":{"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"},"reviewer":{"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"},"state":"REVIEWER"},{"updated":"2018-01-16 07:55:37.000000000","updated_by":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"reviewer":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2018-01-19 10:21:00.000000000","updated_by":{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},"reviewer":{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},"state":"REVIEWER"},{"updated":"2019-11-22 18:25:34.000000000","updated_by":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"reviewer":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"state":"REVIEWER"}],"messages":[{"id":"ca9387d9d3a346cc439912284b11a5cd5cd788be","author":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"real_author":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"date":"2018-01-13 20:02:20.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c3062c9d0f8ef2686735ec5ef8dcd0affa77b75a","author":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"real_author":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"date":"2018-01-13 20:20:05.000000000","message":"Patch Set 1: Verified+1\n\nBuild Successful \n\nhttp://build.openocd.org/job/openocd-gerrit/9566/ : SUCCESS\n\nhttp://build.openocd.org/job/openocd-gerrit-build/8940/ : SUCCESS","accounts_in_message":[],"_revision_number":1},{"id":"106fc8a47518730bb6aff99719d1f8662f9fd2fe","author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"real_author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"date":"2018-01-15 17:21:53.000000000","message":"Patch Set 1:\n\n(1 comment)\n\nThe SUSE Security Team have requested a CVE number from Mitre for this vulnerability. Please update the commit message to include that identifier once available.\n\nCf. https://bugzilla.suse.com/show_bug.cgi?id\u003d1075965","accounts_in_message":[],"_revision_number":1},{"id":"b2bde519ef38de2cfbcb929604c41dfda68d58fb","author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"real_author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"date":"2018-01-15 18:43:37.000000000","message":"Patch Set 1: Code-Review-1\n\n(1 comment)\n\nSome comments on the mitigation approach:","accounts_in_message":[],"_revision_number":1},{"id":"b6bdf0f118e3e294f32725bb8af3ee71b77ab734","author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"real_author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"date":"2018-01-15 18:54:08.000000000","message":"Patch Set 1: Code-Review+1\n\n(1 comment)\n\nI like non-intrusive Tcl-style implementation of this mitigation.","accounts_in_message":[],"_revision_number":1},{"id":"14d8f4a17849fc1600333f902ba1fb17d8de154f","author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"real_author":{"_account_id":1000725,"name":"Andreas Färber","email":"afaerber@suse.de","username":"afaerber"},"date":"2018-01-15 18:58:03.000000000","message":"Patch Set 1: -Code-Review\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"09eadefbac3dd04196e3ce1fd61a4149ad0694da","author":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"real_author":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"date":"2018-01-16 07:38:33.000000000","message":"Patch Set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"b0bd1a0648fa5c839ce426da3c1660b7b622f77a","author":{"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"},"real_author":{"_account_id":1000637,"name":"Jiri Kastner","display_name":"indy","email":"cz172638@gmail.com","username":"indy"},"date":"2018-01-16 07:48:10.000000000","message":"Patch Set 2:\n\nfedora tracker: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1534843","accounts_in_message":[],"_revision_number":2},{"id":"11145ca090dc1d26063d0011ed53959c90f83fc1","author":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"real_author":{"_account_id":1000014,"name":"jenkins","username":"jenkins","tags":["SERVICE_USER"]},"date":"2018-01-16 07:55:37.000000000","message":"Patch Set 2: Verified+1\n\nBuild Successful \n\nhttp://build.openocd.org/job/openocd-gerrit/9585/ : SUCCESS\n\nhttp://build.openocd.org/job/openocd-gerrit-build/8957/ : SUCCESS","accounts_in_message":[],"_revision_number":2},{"id":"819dac878a8e52e2bc6054ca2220058c39c14c25","author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"real_author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"date":"2018-01-19 10:18:53.000000000","message":"Patch Set 2: Code-Review+1\n\nI am still amazed and somewhat angered that it\u0027s considered to be a vulnerability in OpenOCD and CVE is filed against it, while the real offenders (web browsers that run untrusted code in dangerous ways) are not getting fixed!","accounts_in_message":[],"_revision_number":2},{"id":"6c8f401b428a2ff8bbcbd9b27b7abef6cd93d9c7","author":{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},"real_author":{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},"date":"2018-01-19 10:21:00.000000000","message":"Patch Set 2: Code-Review+1\n\nI pulled this change into the 0.10.0-4 Debian OpenOCD package, after testing it locally to check it works as expected. It seems like a sensible minimum mitigation.","accounts_in_message":[],"_revision_number":2},{"id":"112f78d54e9731666afb90900009536dc8bd53d2","author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"real_author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"date":"2018-01-19 10:23:13.000000000","message":"Patch Set 2:\n\nThank you Jonathan! Is it possible to file bugs against the web browsers in cases like that? I think it\u0027s clearly their fault.","accounts_in_message":[],"_revision_number":2},{"id":"6d7dc666d56c9ff1fd9629fa319a880fbd5a68d7","author":{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},"real_author":{"_account_id":1001415,"name":"Jonathan McDowell","email":"noodles-openocd@earth.li","username":"u1f35c"},"date":"2018-01-19 18:04:12.000000000","message":"Patch Set 2:\n\n\u003e Thank you Jonathan! Is it possible to file bugs against the web\n \u003e browsers in cases like that? I think it\u0027s clearly their fault.\n\nI\u0027m not entirely sure how the web browsers can easily do better; it should be possible to send data to a website other than the originating one, potentially on a different host, and I\u0027m not sure you\u0027d want to prevent the ability to do that to localhost (I\u0027ve been in situations where that is a desired thing). In the long term I think OpenOCD needs some form of authentication because at present it\u0027s opening up access to the user account running OpenOCD to anyone else on the machine (with the localhost bind default).","accounts_in_message":[],"_revision_number":2},{"id":"62688f67d2dfac0bb4736c06abd3bf4d687d35ef","author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"real_author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"date":"2018-01-19 18:37:44.000000000","message":"Patch Set 2:\n\nI think web-browsers shouldn\u0027t be able to run untrusted code by default. And even when they do, they shouldn\u0027t be able to issue connections to non-originating hosts by default. Regarding authentication for localhost connections, I guess it would be enough to default to using per-user network namespaces, this can be implemented on distro level with a PAM plugin probably?","accounts_in_message":[],"_revision_number":2},{"id":"7bbca7b8f07fa261dfc13e7835caec067dba68cb","author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"real_author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"date":"2019-11-22 18:21:16.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"5928a04474242e248793576893bab860be0257ed","author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"real_author":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"date":"2019-11-22 18:25:34.000000000","message":"Change has been successfully cherry-picked as 6d54d905413243cc65687e30669a94037a14cbe6 by Paul Fertser","accounts_in_message":[],"_revision_number":3}],"current_revision":"6d54d905413243cc65687e30669a94037a14cbe6","revisions":{"3a223ca3ebc7ac24d7726a0cd58e5695bc813657":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2018-01-16 07:38:33.000000000","uploader":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"ref":"refs/changes/35/4335/2","fetch":{"anonymous http":{"url":"https://review.openocd.org/openocd","ref":"refs/changes/35/4335/2","commands":{"Branch":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/2 \u0026\u0026 git checkout -b change-4335 FETCH_HEAD","Checkout":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.openocd.org/openocd refs/changes/35/4335/2","Reset To":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"22ad1c0f6057aed642d5b1229b24e52dd26b1ec4","subject":"server/telnet: Use proper data types"}],"author":{"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","date":"2018-01-13 20:00:47.000000000","tz":60},"committer":{"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","date":"2018-01-16 07:38:03.000000000","tz":0},"subject":"CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks","message":"CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks\n\nOpenOCD can be targeted by a Cross Protocol Scripting attack from\na web browser running malicious code, such as the following PoC:\n\nvar x \u003d new XMLHttpRequest();\nx.open(\"POST\", \"http://127.0.0.1:4444\", true);\nx.send(\"exec xcalc\\r\\n\");\n\nThis mitigation should provide some protection from browser-based\nattacks and is based on the corresponding fix in Redis:\n\nhttps://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758\n\nChange-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581\nSigned-off-by: Andreas Fritiofson \u003candreas.fritiofson@gmail.com\u003e\nReported-by: Josef Gajdusek \u003catx@atx.name\u003e\n"}},"6d54d905413243cc65687e30669a94037a14cbe6":{"kind":"REWORK","_number":3,"created":"2019-11-22 18:25:34.000000000","uploader":{"_account_id":1000160,"name":"Paul Fertser","email":"fercerpav@gmail.com","username":"pfertser"},"ref":"refs/changes/35/4335/3","fetch":{"anonymous http":{"url":"https://review.openocd.org/openocd","ref":"refs/changes/35/4335/3","commands":{"Branch":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/3 \u0026\u0026 git checkout -b change-4335 FETCH_HEAD","Checkout":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.openocd.org/openocd refs/changes/35/4335/3","Reset To":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"9de7d9c81d91a5cfc16a1476d558d92b08d7e596","subject":"STM8 Target relicensing to GPLv2 and later"}],"author":{"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","date":"2018-01-13 20:00:47.000000000","tz":60},"committer":{"name":"Paul Fertser","email":"fercerpav@gmail.com","date":"2019-11-22 18:25:34.000000000","tz":0},"subject":"CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks","message":"CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks\n\nOpenOCD can be targeted by a Cross Protocol Scripting attack from\na web browser running malicious code, such as the following PoC:\n\nvar x \u003d new XMLHttpRequest();\nx.open(\"POST\", \"http://127.0.0.1:4444\", true);\nx.send(\"exec xcalc\\r\\n\");\n\nThis mitigation should provide some protection from browser-based\nattacks and is based on the corresponding fix in Redis:\n\nhttps://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758\n\nChange-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581\nSigned-off-by: Andreas Fritiofson \u003candreas.fritiofson@gmail.com\u003e\nReported-by: Josef Gajdusek \u003catx@atx.name\u003e\nReviewed-on: http://openocd.zylin.com/4335\nTested-by: jenkins\nReviewed-by: Jonathan McDowell \u003cnoodles-openocd@earth.li\u003e\nReviewed-by: Paul Fertser \u003cfercerpav@gmail.com\u003e\n"}},"98a97899e50c4e2b933636c2661afc169032ceb7":{"kind":"REWORK","_number":1,"created":"2018-01-13 20:02:20.000000000","uploader":{"_account_id":1000005,"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","username":"Nattgris"},"ref":"refs/changes/35/4335/1","fetch":{"anonymous http":{"url":"https://review.openocd.org/openocd","ref":"refs/changes/35/4335/1","commands":{"Branch":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/1 \u0026\u0026 git checkout -b change-4335 FETCH_HEAD","Checkout":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.openocd.org/openocd refs/changes/35/4335/1","Reset To":"git fetch https://review.openocd.org/openocd refs/changes/35/4335/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"22ad1c0f6057aed642d5b1229b24e52dd26b1ec4","subject":"server/telnet: Use proper data types"}],"author":{"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","date":"2018-01-13 20:00:47.000000000","tz":60},"committer":{"name":"Andreas Fritiofson","email":"andreas.fritiofson@gmail.com","date":"2018-01-13 20:01:46.000000000","tz":60},"subject":"Prevent some forms of Cross Protocol Scripting attacks","message":"Prevent some forms of Cross Protocol Scripting attacks\n\nOpenOCD can be targeted by a Cross Protocol Scripting attack from\na web browser running malicious code, such as the following PoC:\n\nvar x \u003d new XMLHttpRequest();\nx.open(\"POST\", \"http://127.0.0.1:4444\", true);\nx.send(\"exec xcalc\\r\\n\");\n\nThis mitigation should provide some protection from browser-based\nattacks and is based on the corresponding fix in Redis:\n\nhttps://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758\n\nChange-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581\nSigned-off-by: Andreas Fritiofson \u003candreas.fritiofson@gmail.com\u003e\nFound-by: Josef Gajdusek \u003catx@atx.name\u003e\n"}}},"requirements":[],"submit_records":[],"submit_requirements":[]}