CVE-2011-3211 (Python, published 2011-09-16T12:35Z)
Description: value: The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/solj/bcfg2
Files changed:
src/lib/Server/Admin/Viz.py
src/lib/Server/Plugins/Hg.py
src/lib/Server/Plugins/SSHbase.py
src/lib/Server/Plugins/SSLCA.py
src/lib/Server/Plugins/Svn.py
Commit message: fixed security bugs with unescaped input to the shell


Vulnerable code:
        cmd = "dot -T%s" % (format)
            cmd += " -o %s" % output
        dotpipe = Popen(cmd, shell=True, stdin=PIPE,
                        stdout=PIPE, close_fds=True)
from subprocess import Popen, PIPE
                cmd = "getent hosts %s" % client
                ipaddr = Popen(cmd, shell=True, \
            cmd = "openssl genrsa %s " % bits
            cmd = "openssl dsaparam -noout -genkey %s" % bits
        key = Popen(cmd, shell=True, stdout=PIPE).stdout.read()
        cmd = "openssl verify -CAfile %s %s" % (chaincert, cert)
        res = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT).stdout.read()
        cmd = "openssl x509 -noout -modulus -in %s | openssl md5" % cert
        cmd = "openssl rsa -noout -modulus -in %s | openssl md5" % key
            cmd = "openssl ca -config %s -in %s -days %s -batch -passin pass:%s" % (ca_config,
                                                                                    req,
                                                                                    days,
                                                                                    passphrase)
        else:
            cmd = "openssl ca -config %s -in %s -days %s -batch" % (ca_config,
                                                                    req,
                                                                    days)
        cert = Popen(cmd, shell=True, stdout=PIPE).stdout.read()
        cmd = "openssl req -new -config %s -days %s -key %s -text -out %s" % (req_config,
                                                                              days,
                                                                              key,
                                                                              req)
                         (self.datastore)), shell=True,

Fixed code:
        cmd = ["dot", "-T", format]
            cmd.extend(["-o", output])
        dotpipe = Popen(cmd, stdin=PIPE, stdout=PIPE, close_fds=True)
                ipaddr = Popen(["getent", "hosts", client],
import pipes
            cmd = ["openssl", "genrsa", bits]
            cmd = ["openssl", "dsaparam", "-noout", "-genkey", bits]
        key = Popen(cmd, stdout=PIPE).stdout.read()
        res = Popen(["openssl", "verify", "-CAfile", chaincert, cert],
                    stdout=PIPE, stderr=STDOUT).stdout.read()
        cmd = ("openssl x509 -noout -modulus -in %s | openssl md5" %
               pipes.quote(cert))
        cmd = ("openssl rsa -noout -modulus -in %s | openssl md5" %
               pipes.quote(key))
        cmd = ["openssl", "ca", "-config", ca_config, "-in", req,
               "-days", days, "-batch"]
            cmd.extend(["-passin", "pass:%s" % passphrase])
        cert = Popen(cmd, stdout=PIPE).stdout.read()
        cmd = ["openssl", "req", "-new", "-config", req_config,
               "-days", days, "-key", key, "-text", "-out", req]
                         pipes.quote(self.datastore)), shell=True,