From 9d0695647cb6f6209e68231fd165917123aa502d Mon Sep 17 00:00:00 2001 From: Allison Karlitskaya Date: Tue, 24 Mar 2026 15:44:15 +0100 Subject: [PATCH] ws: be more explicit when handling hostnames on cli `cockpit-ws` has never protected hostnames from being interpreted as cli options when passing them to the auth commands (`cockpit-session`, `cockpit-ssh`, `cockpit.beiboot`). There have been a couple of relevant changes over the years: - our move to using cockpit-session via unix socket has removed exposure to this problem for `cockpit-session` - our move from `cockpit-ssh` (glib argument parser) to `cockpit.beiboot` (Python argparse) has unfortunately exposed us to https://github.com/python/cpython/issues/66623 which means (due to a strange heuristic) that arguments starting with '-' can be interpreted as positionals if they also have spaces in them This gives a way to get a hostname starting with a `-` to ssh (where it *will* be interpreted as an option) and the following argument (the python invocation on the remote) will be interpreted as the hostname. Fortunately, new versions of ssh will reject this hostname. In any case, we should firm up the code here and add `--` to ensure that it's definitely interpreted as a hostname by ssh. For a similar reason add a `--` to the ssh command in `cockpit-ws`. CVE-2026-4631 --- src/cockpit/beiboot.py | 4 ++-- src/ws/cockpitauth.c | 2 +- vendor/ferny | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/cockpit/beiboot.py b/src/cockpit/beiboot.py index e26f61e315..b0dffcb51a 100644 --- a/src/cockpit/beiboot.py +++ b/src/cockpit/beiboot.py @@ -250,9 +250,9 @@ def via_ssh(cmd: Sequence[str], dest: str, ssh_askpass: Path, *ssh_opts: str) -> # strip off [] IPv6 brackets if host.startswith('[') and host.endswith(']'): host = host[1:-1] - destination = ['-p', port, host] + destination = ['-p', port, '--', host] else: - destination = [dest] + destination = ['--', dest] return ( 'ssh', *ssh_opts, *destination, shlex.join(cmd) diff --git a/src/ws/cockpitauth.c b/src/ws/cockpitauth.c index bbde931f9d..7554ee835c 100644 --- a/src/ws/cockpitauth.c +++ b/src/ws/cockpitauth.c @@ -36,7 +36,7 @@ /* we only support beibooting machines with a known/vetted OS, as it's impossible to guarantee * forward compatibility for all pages */ -const gchar *cockpit_ws_ssh_program = "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported"; +const gchar *cockpit_ws_ssh_program = "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported --"; /* Some tunables that can be set from tests */ const gchar *cockpit_ws_session_program = NULL; diff --git a/vendor/ferny b/vendor/ferny index c8713c4d3b..73dd163349 160000 --- a/vendor/ferny +++ b/vendor/ferny @@ -1 +1 @@ -Subproject commit c8713c4d3ba74a9d8db1ce8e0a15296e6a333257 +Subproject commit 73dd163349bf048d3d0a36f43228a9d052104e30