URLs downloaded with cURL should be stripped of newlines

Bug #1411353 reported by Adam Collard
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Landscape Charm
Fix Released
Critical
David Britton

Bug Description

Following on from the recent fix in cURL to address CVE-2014-8150, cURL rejects URLs with newline characters in them.

The landscape charm is currently failing with a hook error because by virtue of the include-file:// directives newline character is at the end of the license-file config value.

2015-01-15 17:32:22 INFO juju-log Fetching License: http://my.server/license.txt

2015-01-15 17:32:22 INFO config-changed Traceback (most recent call last):
2015-01-15 17:32:22 INFO config-changed File "/var/lib/juju/agents/unit-landscape-msg-0/charm/hooks/config-changed", line 908, in <module>
2015-01-15 17:32:22 INFO config-changed hooks[hook]()
2015-01-15 17:32:22 INFO config-changed File "/var/lib/juju/agents/unit-landscape-msg-0/charm/hooks/config-changed", line 492, in config_changed
2015-01-15 17:32:22 INFO config-changed _install_license()
2015-01-15 17:32:22 INFO config-changed File "/var/lib/juju/agents/unit-landscape-msg-0/charm/hooks/config-changed", line 562, in _install_license
2015-01-15 17:32:22 INFO config-changed license_file = _download_file(license_file)
2015-01-15 17:32:22 INFO config-changed File "/var/lib/juju/agents/unit-landscape-msg-0/charm/hooks/config-changed", line 511, in _download_file
2015-01-15 17:32:22 INFO config-changed curl.perform()
2015-01-15 17:32:22 INFO config-changed pycurl.error: (3, 'Illegal characters found in URL')

Related branches

CVE References

David Britton (dpb)
Changed in landscape-charm:
assignee: nobody → David Britton (davidpbritton)
Changed in landscape-charm:
status: New → Fix Committed
Revision history for this message
David Britton (dpb) wrote :

trusty:r163
precise:r164

Changed in landscape-charm:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.