madwas's Introduction

Hi 👋 I'm Oliver Drechsler

DevOps Engineer, Cloud Architect, Trail-Runner, Marathon Runner, Triathlate and Dad

🔭 Currently working on ...
- Raspberry Front Door Intercom Automation
  - with an extra RasPi Zero Camera with a Rest API - PiCam_API
  - and Blink Camera control additionally
  - connected to BTIcino Intercom
  - send Telegram door bell ring photo notification
  - open Door via message
  - Apple IOS App for iPhone and Watch with geofencing and opening the door with (O)ne(T)ime(P)asswords through telegram privat group.
    - published soon....
- Monitor ARP and DNS queries to wakeup a Server
- Do you like it these open source projects? [Mark it with a GitHub Star ⭐]

🌱 I’m currently developing and learning ... AppleScript, Groovy, Go , Python, Java, Spring and some more ...
💬 Ask me about ...
VDR, Raspberry Pi, Programming Languages, Linux, .....
📫 Connect with me:: ...

📚 Imprint and GDPDR / Impressum und DSGVO

IMPRESSUM

DSGVO

madwas's People

Contributors

Watchers

madwas's Issues

harden logging load of log_config.yaml because of possible arbitrary code execution

pyyaml is a YAML parser and emitter for Python.
Affected versions of this package are vulnerable to Arbitrary Code Execution. It processes untrusted YAML files through the full_load method or with the FullLoader loader. This is due to an incomplete fix for CVE-2020-1747
Remediation
There is no fixed version for pyyaml.

Configuring loggers is security-sensitive. It has led in the past to the following vulnerabilities:
CVE-2018-0285
CVE-2000-1127
CVE-2017-15113
CVE-2015-5742
Sensitive Code Example

import logging
from logging import Logger, Handler, Filter
from logging.config import fileConfig, dictConfig

logging.basicConfig()  # Sensitive
logging.disable()  # Sensitive


def update_logging(logger_class):
    logging.setLoggerClass(logger_class)  # Sensitive


def set_last_resort(last_resort):
    logging.lastResort = last_resort  # Sensitive


class CustomLogger(Logger):  # Sensitive
    pass


class CustomHandler(Handler):  # Sensitive
    pass


class CustomFilter(Filter):  # Sensitive
    pass


def update_config(path, config):
    fileConfig(path)  # Sensitive
    dictConfig(config)  # Sensitive

Recommend Projects