percona/percona-toolkit
1
0
Fork 0
mirror of https://github.com/percona/percona-toolkit.git synced 2025-10-20 09:40:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed security issues in VersionCheck and HTTP::Micro

Browse Source
This commit is contained in:
Frank Cizmich
2015-01-16 16:49:30 -02:00
parent 732a3fa9cc
commit c3462b6c68
20 changed files with 194 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/VersionCheck.pm
View File

@@ -138,17 +138,17 @@ sub version_check {
PTDEBUG && _d(scalar @$instances_to_check, 'instances to check');
return unless @$instances_to_check;
# Get the list of program to check from Percona. Try using
# https first; fallback to http if that fails (probably because
# IO::Socket::SSL isn't installed).
my $protocol = 'https'; # optimistic, but...
# Skip Version Check altogether if SSL not available
my $protocol = 'https';
eval { require IO::Socket::SSL; };
if ( $EVAL_ERROR ) {
PTDEBUG && _d($EVAL_ERROR);
$protocol = 'http';
PTDEBUG && _d("SSL not available, won't run version_check");
return;
}
PTDEBUG && _d('Using', $protocol);
# Get list of programs to check from Percona.
my $advice = pingback(
instances => $instances_to_check,
protocol => $protocol,
@@ -644,6 +644,13 @@ sub get_from_mysql {
return;
}
# hardcode the variables we report
# so in case of MITM attack, we don't report sensitive data
if ($item->{item} eq 'MySQL' && $item->{type} eq 'mysql_variable') {
$item->{vars} = ['version_comment', 'version'];
}
my @versions;
my %version_for;
foreach my $instance ( @$instances ) {