debian/changelog

+koji (1.16.2-1) unstable; urgency=medium
+
+  * New upstream version, fixing CVE-2018-1002161. Closes: #922922
+
+ -- Holger Levsen <holger@debian.org>  Sun, 24 Feb 2019 19:44:30 +0100
+
 koji (1.16.1-1) unstable; urgency=medium
 
   * New upstream version.

docs/source/conf.py

@@ -56,7 +56,7 @@ copyright = u'2017, Mike McLean, Mike B, Dennis Gilmore, Mathieu Bridon, Ian McL
 # The short X.Y version.
 version = '1.16'
 # The full version, including alpha/beta/rc tags.
-release = '1.16.1'
+release = '1.16.2'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

hub/kojihub.py

@@ -4157,8 +4157,10 @@ def list_archives(buildID=None, buildrootID=None, componentBuildrootID=None, hos
                     val = typeInfo[key]
                     if not isinstance(val, (list, tuple)):
                         val = [val]
-                    for v in val:
-                        clauses.append(r"""%s ~ E'\\m%s\\M'""" % (key, v))
+                    for i, v in enumerate(val):
+                        pkey = '%s_pattern_%i' % (key, i)
+                        values[pkey] = r'\m%s\M' % v
+                        clauses.append('%s ~ %%(%s)s' % (key, pkey))
     elif type == 'image':
         joins.append('image_archives ON archiveinfo.id = image_archives.archive_id')
         fields.append(['image_archives.arch', 'arch'])
@@ -6150,13 +6152,15 @@ def get_archive_type(filename=None, type_name=None, type_id=None, strict=False):
         raise koji.GenericError('one of filename, type_name, or type_id must be specified')
     parts = filename.split('.')
-
+    query = QueryProcessor(
+            tables=['archivetypes'],
+            columns=['id', 'name', 'description', 'extensions'],
+            clauses=['extensions ~* %(pattern)s'],
+            )
     for start in range(len(parts)-1, -1, -1):
         ext = '.'.join(parts[start:])
-
-        select = r"""SELECT id, name, description, extensions FROM archivetypes
-                      WHERE extensions ~* E'(\\s|^)%s(\\s|$)'""" % ext
-        results = _multiRow(select, locals(), ('id', 'name', 'description', 'extensions'))
+        query.values['pattern'] = r'(\s|^)%s(\s|$)' % ext
+        results = query.execute()
         if len(results) == 1:
             return results[0]
@@ -10779,8 +10783,8 @@ class RootExports(object):
             # matching 'ppc64'
             if not (isinstance(arches, list) or isinstance(arches, tuple)):
                 arches = [arches]
-            archClause = [r"""arches ~ E'\\m%s\\M'""" % arch for arch in arches]
-            clauses.append('(' + ' OR '.join(archClause) + ')')
+            archPattern = r'\m(%s)\M' % '|'.join(arches)
+            clauses.append('arches ~ %(archPattern)s')
         if channelID is not None:
             channelID = get_channel_id(channelID, strict=True)
             joins.append('host_channels ON host.id = host_channels.host_id')

koji.spec

@@ -31,7 +31,7 @@
 %define release %{baserelease}
 %endif
 Name: koji
-Version: 1.16.1
+Version: 1.16.2
 Release: %{release}%{?dist}
 License: LGPLv2
 Summary: Build system tools
@@ -467,6 +467,9 @@ fi
 %endif
 
 %changelog
+* Thu Feb 21 2019 Mike McLean <mikem at redhat.com> - 1.16.2-1
+- Fix CVE-2018-1002161: SQL injection in multiple remote calls
+
 * Fri Aug 17 2018 Franz Chih-Ping Hsieh <chsieh@redhat.com> - 1.16.1-1
 - PR#1041: fix utf-8 output in CLI
 - PR#1000: Fix target handling in make_task

setup.py

@@ -25,7 +25,7 @@ def get_install_requires():
 
 setup(
     name="koji",
-    version="1.16.0",
+    version="1.16.2",
     description=("Koji is a system for building and tracking RPMS. The base"
                  " package contains shared libraries and the command-line"
                  " interface."),

tests/test_hub/test_list_archives.py

@@ -174,10 +174,14 @@ class TestListArchives(DBQueryTestCase):
                                          'btype ON archiveinfo.btype_id = btype.id',
                                          'win_archives ON archiveinfo.id = win_archives.archive_id'],
                                   clauses=['win_archives.relpath = %(relpath)s',
-                                           r"platforms ~ E'\\mall\\M'",
-                                           r"flags ~ E'\\mA\\M'",
-                                           r"flags ~ E'\\mB\\M'"],
-                                  values={'relpath': 'somerelpath'},
+                                           r"platforms ~ %(platforms_pattern_0)s",
+                                           r"flags ~ %(flags_pattern_0)s",
+                                           r"flags ~ %(flags_pattern_1)s"],
+                                  values={'relpath': 'somerelpath',
+                                          'flags_pattern_0': '\\mA\\M',
+                                          'flags_pattern_1': '\\mB\\M',
+                                          'platforms_pattern_0': '\\mall\\M',
+                                          },
                                   colsByAlias={'relpath': 'win_archives.relpath',
                                                'platforms': 'win_archives.platforms',
                                                'flags': 'win_archives.flags',

tests/test_hub/test_list_hosts.py

@@ -67,7 +67,7 @@ class TestListHosts(unittest.TestCase):
         query = self.queries[0]
         self.assertEqual(query.tables, ['host_config'])
         self.assertEqual(query.joins, ['host ON host.id = host_config.host_id'])
-        self.assertEqual(query.clauses, ['host_config.active IS TRUE',r"""(arches ~ E'\\mx86_64\\M')"""])
+        self.assertEqual(query.clauses, ['host_config.active IS TRUE',r"""arches ~ %(archPattern)s"""])
 
     def test_list_hosts_multi_arch(self):
         self.exports.listHosts(arches=['x86_64', 's390'])
@@ -76,7 +76,7 @@ class TestListHosts(unittest.TestCase):
         query = self.queries[0]
         self.assertEqual(query.tables, ['host_config'])
         self.assertEqual(query.joins, ['host ON host.id = host_config.host_id'])
-        self.assertEqual(query.clauses, ['host_config.active IS TRUE',r"""(arches ~ E'\\mx86_64\\M' OR arches ~ E'\\ms390\\M')"""])
+        self.assertEqual(query.clauses, ['host_config.active IS TRUE',r"""arches ~ %(archPattern)s"""])
 
     def test_list_hosts_bad_arch(self):
         with self.assertRaises(koji.GenericError):