From b2f112259867f0e495edde65ce608381502ec847 Mon Sep 17 00:00:00 2001
From: GuoCe <guoce@kylinos.cn>
Date: Mon, 6 May 2024 17:17:38 +0800
Subject: [PATCH]  [ovirt] answer files: Filter out all password keys

Instead of hard-coding specific keys and having to maintain them over
time, replace the values of all keys that have 'password' in their name.
I think this covers all our current and hopefully future keys. It might
add "false positives" - keys that are not passwords but have 'password'
in their name - and I think that's a risk worth taking.

Sadly, the engine admin password prompt's name is
'OVESETUP_CONFIG_ADMIN_SETUP', which does not include 'password', so has
to be listed specifically.

A partial list of keys added since the replaced code was written:
- grafana-related stuff
- keycloak-related stuff
- otopi-style answer files

Signed-off-by: Yedidyah Bar David <didi@redhat.com>
Change-Id: I416c6e4078e7c3638493eb271d08d73a0c22b5ba
---
 ...r-files-Filter-out-all-password-keys.patch | 64 +++++++++++++++++++
 sos.spec                                      |  6 +-
 2 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 backport-ovirt-answer-files-Filter-out-all-password-keys.patch

diff --git a/backport-ovirt-answer-files-Filter-out-all-password-keys.patch b/backport-ovirt-answer-files-Filter-out-all-password-keys.patch
new file mode 100644
index 0000000..9f55d38
--- /dev/null
+++ b/backport-ovirt-answer-files-Filter-out-all-password-keys.patch
@@ -0,0 +1,64 @@
+From 1715b06b32cd3db95b45da044e6760574d7f5055 Mon Sep 17 00:00:00 2001
+From: GuoCe <guoce@kylinos.cn>
+Date: Mon, 6 May 2024 17:14:22 +0800
+Subject: [PATCH]  [ovirt] answer files: Filter out all password keys
+
+Instead of hard-coding specific keys and having to maintain them over
+time, replace the values of all keys that have 'password' in their name.
+I think this covers all our current and hopefully future keys. It might
+add "false positives" - keys that are not passwords but have 'password'
+in their name - and I think that's a risk worth taking.
+
+Sadly, the engine admin password prompt's name is
+'OVESETUP_CONFIG_ADMIN_SETUP', which does not include 'password', so has
+to be listed specifically.
+
+A partial list of keys added since the replaced code was written:
+- grafana-related stuff
+- keycloak-related stuff
+- otopi-style answer files
+
+Signed-off-by: Yedidyah Bar David <didi@redhat.com>
+Change-Id: I416c6e4078e7c3638493eb271d08d73a0c22b5ba
+---
+ sos/plugins/ovirt.py | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/sos/plugins/ovirt.py b/sos/plugins/ovirt.py
+index 69c7867..a03afbf 100644
+--- a/sos/plugins/ovirt.py
++++ b/sos/plugins/ovirt.py
+@@ -207,18 +207,21 @@ class Ovirt(Plugin, RedHatPlugin):
+             )
+ 
+         # Answer files contain passwords
+-        for key in (
+-            'OVESETUP_CONFIG/adminPassword',
+-            'OVESETUP_CONFIG/remoteEngineHostRootPassword',
+-            'OVESETUP_DWH_DB/password',
+-            'OVESETUP_DB/password',
+-            'OVESETUP_REPORTS_CONFIG/adminPassword',
+-            'OVESETUP_REPORTS_DB/password',
++        # Replace all keys that have 'password' in them, instead of hard-coding
++        # here the list of keys, which changes between versions.
++        # Sadly, the engine admin password prompt name does not contain
++        # 'password'... so neither does the env key.
++        for item in (
++            'password',
++            'OVESETUP_CONFIG_ADMIN_SETUP',
+         ):
+             self.do_path_regex_sub(
+                 r'/var/lib/ovirt-engine/setup/answers/.*',
+-                r'{key}=(.*)'.format(key=key),
+-                r'{key}=********'.format(key=key)
++                re.compile(
++                    r'(?P<key>[^=]*{item}[^=]*)=.*'.format(item=item),
++                    flags=re.IGNORECASE
++                ),
++                r'\g<key>=********'
+             )
+ 
+         # aaa profiles contain passwords
+-- 
+2.27.0
+
diff --git a/sos.spec b/sos.spec
index 3694d60..387d8ea 100644
--- a/sos.spec
+++ b/sos.spec
@@ -2,7 +2,7 @@
 
 Name:          sos
 Version:       3.8
-Release:       3
+Release:       4
 Summary:       A set of tools to gather troubleshooting information from a system
 License:       GPLv2+
 URL:           https://github.com/sosreport/sos
@@ -10,6 +10,7 @@ Source0:       https://github.com/sosreport/sos/archive/%{version}/%{name}-%{ver
 
 Patch9000:     openEuler-add-openEuler-policy.patch
 Patch9001:     UnionTech-add-UnionTech-policy.patch
+Patch9002:     backport-ovirt-answer-files-Filter-out-all-password-keys.patch
 
 BuildRequires: python3-devel gettext python3-six
 Requires:      libxml2-python3 xz python3-rpm tar bzip2 python3-six
@@ -47,6 +48,9 @@ install -Dm644 %{name}.conf %{buildroot}%{_sysconfdir}/%{name}.conf
 %{_mandir}/man5/*
 
 %changelog
+* Mon May 06 2024 GuoCe <guoce@kylinos.cn> - 3.8-4
+- Fix CVE-2022-2806
+
 * Tue Nov 30 2021 shixuantong <shixuantong@huawei.com> - 3.8-3
 - fix TypeError: __init__() got an unexpected keyword argument 'init'