Skip to content

Conversation

@smuzaffar
Copy link
Contributor

@smuzaffar smuzaffar commented Oct 17, 2023

New version contains the Blind local file inclusion issue

In order to resolve some git references, GitPython reads files from the .git directory, 
in some places the name of the file being read is provided by the user, GitPython 
doesn't check if this file is located outside the .git directory. This allows an attacker 
to make GitPython read any file from the system.

@cmsbuild
Copy link
Contributor

A new Pull Request was created by @smuzaffar (Malik Shahzad Muzaffar) for branch IB/CMSSW_13_3_X/master.

@aandvalenzuela, @smuzaffar, @iarspider, @cmsbuild can you please review it and eventually sign? Thanks.
@antoniovilela, @sextonkennedy, @rappoccio you are the release manager for this.
cms-bot commands are listed here

@smuzaffar
Copy link
Contributor Author

please test

@cmsbuild
Copy link
Contributor

+1

Summary: https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-75be8b/35235/summary.html
COMMIT: 24bb044
CMSSW: CMSSW_13_3_X_2023-10-17-1100/el8_amd64_gcc12
User test area: For local testing, you can use /cvmfs/cms-ci.cern.ch/week1/cms-sw/cmsdist/8765/35235/install.sh to create a dev area with all the needed externals and cmssw changes.

The following merge commits were also included on top of IB + this PR after doing git cms-merge-topic:

You can see more details here:
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-75be8b/35235/git-recent-commits.json
https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-75be8b/35235/git-merge-result

Comparison Summary

Summary:

  • You potentially added 1 lines to the logs
  • Reco comparison results: 2987 differences found in the comparisons
  • DQMHistoTests: Total files compared: 50
  • DQMHistoTests: Total histograms compared: 3357400
  • DQMHistoTests: Total failures: 6126
  • DQMHistoTests: Total nulls: 0
  • DQMHistoTests: Total successes: 3351252
  • DQMHistoTests: Total skipped: 22
  • DQMHistoTests: Total Missing objects: 0
  • DQMHistoSizes: Histogram memory added: 0.0 KiB( 49 files compared)
  • Checked 214 log files, 167 edm output root files, 50 DQM output files
  • TriggerResults: found differences in 1 / 48 workflows

@smuzaffar
Copy link
Contributor Author

+externals

@smuzaffar smuzaffar merged commit 43f0894 into IB/CMSSW_13_3_X/master Oct 18, 2023
@smuzaffar smuzaffar deleted the smuzaffar-patch-6 branch October 18, 2023 05:34
@cmsbuild
Copy link
Contributor

This pull request is fully signed and it will be integrated in one of the next IB/CMSSW_13_3_X/master IBs (tests are also fine). This pull request will now be reviewed by the release team before it's merged. @rappoccio, @sextonkennedy, @antoniovilela (and backports should be raised in the release meeting by the corresponding L2)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants