From 16b3a351cc4bc5d5e37c82514d7ef363ceb29aa8 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 1/10] use QueryProcessor in get_archive_type


---

diff --git a/hub/kojihub.py b/hub/kojihub.py
index 46b8f3e..78352db 100644
--- a/hub/kojihub.py
+++ b/hub/kojihub.py
@@ -6222,13 +6222,15 @@ def get_archive_type(filename=None, type_name=None, type_id=None, strict=False):
         raise koji.GenericError('one of filename, type_name, or type_id must be specified')
 
     parts = filename.split('.')
-
+    query = QueryProcessor(
+            tables=['archivetypes'],
+            columns=['id', 'name', 'description', 'extensions'],
+            clauses=['extensions ~* %(pattern)s'],
+            )
     for start in range(len(parts)-1, -1, -1):
         ext = '.'.join(parts[start:])
-
-        select = r"""SELECT id, name, description, extensions FROM archivetypes
-                      WHERE extensions ~* E'(\\s|^)%s(\\s|$)'""" % ext
-        results = _multiRow(select, locals(), ('id', 'name', 'description', 'extensions'))
+        query.values['pattern'] = r'(\s|^)%s(\s|$)' % ext
+        results = query.execute()
 
         if len(results) == 1:
             return results[0]

From 4eb3f50d1be6050e46e30fef0ee70ffedd66a54f Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 2/10] fix arches handling in listHosts


---

diff --git a/hub/kojihub.py b/hub/kojihub.py
index 78352db..b4b4eb1 100644
--- a/hub/kojihub.py
+++ b/hub/kojihub.py
@@ -10889,8 +10889,8 @@ class RootExports(object):
             # matching 'ppc64'
             if not isinstance(arches, (list, tuple)):
                 arches = [arches]
-            archClause = [r"""arches ~ E'\\m%s\\M'""" % arch for arch in arches]
-            clauses.append('(' + ' OR '.join(archClause) + ')')
+            archPattern = r'\m(%s)\M' % '|'.join(arches)
+            clauses.append('arches ~ %(archPattern)s')
         if channelID is not None:
             channelID = get_channel_id(channelID, strict=True)
             joins.append('host_channels ON host.id = host_channels.host_id')

From c41a7a52a5d55290acd8bd7deb5295b66fd1ac61 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 3/10] fix typeInfo handling in list_archives


---

diff --git a/hub/kojihub.py b/hub/kojihub.py
index b4b4eb1..b3f06b5 100644
--- a/hub/kojihub.py
+++ b/hub/kojihub.py
@@ -4207,8 +4207,10 @@ def list_archives(buildID=None, buildrootID=None, componentBuildrootID=None, hos
                     val = typeInfo[key]
                     if not isinstance(val, (list, tuple)):
                         val = [val]
-                    for v in val:
-                        clauses.append(r"""%s ~ E'\\m%s\\M'""" % (key, v))
+                    for i, v in enumerate(val):
+                        pkey = '%s_pattern_%i' % (key, i)
+                        values[pkey] = r'\m%s\M' % v
+                        clauses.append('%s ~ %%(%s)s' % (key, pkey))
     elif type == 'image':
         joins.append('image_archives ON archiveinfo.id = image_archives.archive_id')
         fields.append(['image_archives.arch', 'arch'])

From f6f2984e18ed2d9fa39be654b1b4340d7ed8678c Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 4/10] fix unit test for list_archives


---

diff --git a/tests/test_hub/test_list_archives.py b/tests/test_hub/test_list_archives.py
index 60694af..a70b549 100644
--- a/tests/test_hub/test_list_archives.py
+++ b/tests/test_hub/test_list_archives.py
@@ -177,10 +177,14 @@ class TestListArchives(DBQueryTestCase):
                                          'win_archives ON archiveinfo.id = win_archives.archive_id']),
                                   clauses=sorted([
                                            'win_archives.relpath = %(relpath)s',
-                                           r"platforms ~ E'\\mall\\M'",
-                                           r"flags ~ E'\\mA\\M'",
-                                           r"flags ~ E'\\mB\\M'"]),
-                                  values={'relpath': 'somerelpath'},
+                                           r"platforms ~ %(platforms_pattern_0)s",
+                                           r"flags ~ %(flags_pattern_0)s",
+                                           r"flags ~ %(flags_pattern_1)s"]),
+                                  values={'relpath': 'somerelpath',
+                                          'flags_pattern_0': '\\mA\\M',
+                                          'flags_pattern_1': '\\mB\\M',
+                                          'platforms_pattern_0': '\\mall\\M',
+                                          },
                                   colsByAlias={'relpath': 'win_archives.relpath',
                                                'platforms': 'win_archives.platforms',
                                                'flags': 'win_archives.flags',

From 208c6433d751cca389f4a3085119ef1731e7c2cc Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 5/10] fix unit tests for listHosts


---

diff --git a/tests/test_hub/test_list_hosts.py b/tests/test_hub/test_list_hosts.py
index a2b8ecd..4c51da2 100644
--- a/tests/test_hub/test_list_hosts.py
+++ b/tests/test_hub/test_list_hosts.py
@@ -71,8 +71,8 @@ class TestListHosts(unittest.TestCase):
         query = self.queries[0]
         self.assertEqual(query.tables, ['host_config'])
         self.assertEqual(query.joins, ['host ON host.id = host_config.host_id'])
-        self.assertEqual(query.clauses, [r"""(arches ~ E'\\mx86_64\\M')""",
-                                             'host_config.active IS TRUE'])
+        self.assertEqual(query.clauses, ['arches ~ %(archPattern)s',
+                                        'host_config.active IS TRUE'])
 
     def test_list_hosts_multi_arch(self):
         self.exports.listHosts(arches=['x86_64', 's390'])
@@ -82,7 +82,7 @@ class TestListHosts(unittest.TestCase):
         self.assertEqual(query.tables, ['host_config'])
         self.assertEqual(query.joins, ['host ON host.id = host_config.host_id'])
         self.assertEqual(query.clauses, [
-            r"""(arches ~ E'\\mx86_64\\M' OR arches ~ E'\\ms390\\M')""",
+            'arches ~ %(archPattern)s',
             'host_config.active IS TRUE'])
 
     def test_list_hosts_bad_arch(self):

From 5671aba4d4fceaba47e6bb38959102e356b07e95 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 6/10] CVE-2018-1002161 announcement text


---

diff --git a/docs/source/CVE-2018-1002161.rst b/docs/source/CVE-2018-1002161.rst
new file mode 100644
index 0000000..33fb6c9
--- /dev/null
+++ b/docs/source/CVE-2018-1002161.rst
@@ -0,0 +1,66 @@
+================
+CVE-2018-1002161
+================
+
+SQL injection in multiple remote calls
+
+.. toctree::
+    :hidden:
+
+    CVE-2018-1002161-FAQ
+
+
+Summary
+-------
+
+This is a critical security bug.
+
+Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection bugs. By
+passing carefully constructed arguments to these calls, an unauthenticated user
+can issue arbitrary SQL commands to Koji’s database. This gives the attacker
+broad ability to manipulate or destroy data.
+
+There is no known workaround. All Koji admins are encouraged to update to a
+fixed version as soon as possible.
+
+
+
+Bug fix
+-------
+
+Note: because code fixes can take time to deploy, we recommend
+that all admins shut down their Koji hub instances until the fix
+can be applied.
+
+We are releasing updates for several recent versions of Koji to fix this
+bug. The following `releases <https://pagure.io/koji/releases>`_ all
+contain the fix:
+
+-  1.16.2
+-  1.15.2
+-  1.14.2
+-  1.13.2
+-  1.12.2
+-  1.11.1
+
+Note: the legacy-py24 branch is unaffected since it
+is client-only (no hub).
+
+For users who have customized their Koji code, we recommend rebasing
+your work onto the appropriate update release. If this is not feasible,
+the patch should be very easy to apply. Please see `issue
+#1183 <https://pagure.io/koji/issue/1183>`_ for the code details.
+
+As with all changes to hub code, you must restart httpd for the changes
+to take effect.
+
+Links
+-----
+
+Fixed versions can be found at our releases page:
+
+    https://pagure.io/koji/releases
+
+Questions and answers about this issue
+
+    :doc:`CVE-2018-1002161-FAQ`

From 158e668318fda69a2bd9aeca054777a020620544 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 7/10] CVE-2018-1002161 FAQ


---

diff --git a/docs/source/CVE-2018-1002161-FAQ.rst b/docs/source/CVE-2018-1002161-FAQ.rst
new file mode 100644
index 0000000..bb7b83d
--- /dev/null
+++ b/docs/source/CVE-2018-1002161-FAQ.rst
@@ -0,0 +1,66 @@
+========================
+FAQ for CVE-2018-1002161
+========================
+
+Following are answers to some questions regarding CVE-2018-1002161
+for Koji. If you haven’t already, you should read the
+:doc:`announcement <CVE-2018-1002161>`.
+
+If you have questions not covered here or in the announcement, please
+ask them on the koji-devel mailing list.
+
+    https://lists.fedorahosted.org/archives/list/koji-devel@lists.fedorahosted.org/
+
+Q: Does this issue affect Koji clients or builders?
+
+    The issue only affects the Koji hub.
+
+Q: Which versions of Koji are affected?
+
+    All previous versions of Koji are affected, except for the legacy-py24
+    branch because it contains no hub code.
+
+Q: Where are the fixed versions?
+
+    | For Koji 1.11, 1.11.1 and higher include the fix
+    | For Koji 1.12, 1.12.2 and higher include the fix
+    | For Koji 1.13, 1.13.2 and higher include the fix
+    | For Koji 1.14, 1.14.2 and higher include the fix
+    | For Koji 1.15, 1.15.2 and higher include the fix
+    | For Koji 1.16.2 and higher include the fix
+
+    You can find all of these versions on our releases page:
+
+    https://pagure.io/koji/releases
+
+Q: What about older versions?
+
+    We have only backported the fix to Koji versions released in the past few
+    years. If you are still using a very old version of Koji, we strongly
+    recommend that you shut it down and migrate to a newer version.
+
+Q: What can be done with this exploit?
+
+    The attacker can directly manipulate the database as they see fit. This
+    would, among other things, allow them to gain the admin permission within
+    Koji. They could destroy or corrupt the database, add new builds, replace
+    existing builds, or any number of other things.
+
+Q: Can the attacker execute arbitrary code?
+
+    On the hub, not that we know of.
+
+    However, they could create arbitrary tasks, which would be run by the build
+    hosts.
+
+Q: Where can I get more help?
+
+    You can ask questions on the koji-devel mailing list
+    (`koji-devel@fedorahosted.org <mailto:koji-devel@fedorahosted.org>`_).
+
+    For real time communication, we have the #koji IRC channel on
+    `Freenode <https://freenode.net/>`_.
+    The best time to ask would be during the Koji devel team
+    “office hours”, which are held each Tuesday and Thursday from
+    10-11am eastern time.
+

From 52cfc578b6bb5381ec816ccd9ff1b8d94e3efdba Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 8/10] update cve index


---

diff --git a/docs/source/CVEs.rst b/docs/source/CVEs.rst
index 8af389c..4b4d9aa 100644
--- a/docs/source/CVEs.rst
+++ b/docs/source/CVEs.rst
@@ -5,5 +5,6 @@ Koji CVEs
 .. toctree::
     :titlesonly:
 
+    CVE-2018-1002161
     CVE-2018-1002150
     CVE-2017-1002153

From f6c911fb632386a752948199915f866cc0aaeb03 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 9/10] 1.16.2 release notes


---

diff --git a/docs/source/release_notes.rst b/docs/source/release_notes.rst
index d98e8e9..4c087f5 100644
--- a/docs/source/release_notes.rst
+++ b/docs/source/release_notes.rst
@@ -5,6 +5,8 @@ Release Notes
 .. toctree::
     :maxdepth: 1
 
+    release_notes_1.16.2
+    release_notes_1.16.1
     release_notes_1.16
     release_notes_1.15.1
     release_notes_1.15
diff --git a/docs/source/release_notes_1.16.2.rst b/docs/source/release_notes_1.16.2.rst
new file mode 100644
index 0000000..432b932
--- /dev/null
+++ b/docs/source/release_notes_1.16.2.rst
@@ -0,0 +1,18 @@
+Koji 1.16.2 Release Notes
+=========================
+
+Koji 1.16.2 is a bugfix release for Koji 1.16.
+The purpose of this release is address  :doc:`CVE-2018-1002161`.
+
+See also:
+
+- :doc:`release_notes_1.16.1`
+
+- :doc:`release_notes_1.16`
+
+
+Issues fixed in 1.16.2
+----------------------
+
+- `Issue 1183 <https://pagure.io/koji/issue/1183>`_ --
+  CVE-2018-1002161

From f88ebd494c1d85433c37f0b55da5ed2949099124 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Feb 21 2019 14:34:47 +0000
Subject: [PATCH 10/10] pull in 1.16.1 release notes for completeness


---

diff --git a/docs/source/release_notes_1.16.1.rst b/docs/source/release_notes_1.16.1.rst
new file mode 100644
index 0000000..eb2f5b3
--- /dev/null
+++ b/docs/source/release_notes_1.16.1.rst
@@ -0,0 +1,59 @@
+Koji 1.16.1 Release Notes
+=========================
+
+Koji 1.16.1 is a point release for Koji 1.16. The major changes include:
+
+- Allow target info to be read for different type tasks in channel policy.
+- Create symlinks for builds imported onto non-default volumes.
+- Fix RPMdiff issues found in Koji 1.16.0.
+
+Please see: :doc:`release_notes_1.16`
+
+Issues fixed in 1.16.1
+----------------------
+
+- `Issue 847 <https://pagure.io/koji/issue/847>`_ --
+  spin-livecd failed with "Could not resolve host"
+
+- `Issue 932 <https://pagure.io/koji/issue/932>`_ --
+  Fix use_host_resolv with new mock version
+
+- `Issue 1010 <https://pagure.io/koji/issue/1010>`_ --
+  koji fails runroot because of `UnicodeDecodeError`
+
+- `Issue 998 <https://pagure.io/koji/issue/998>`_ --
+  cancel build doesn't work for images
+
+- `Issue 994 <https://pagure.io/koji/issue/994>`_ --
+  rpmdiff calculate wrong results
+
+- `Issue 1025 <https://pagure.io/koji/issue/1025>`_ --
+  missing default volume symlink for imported builds affected by volume policy
+
+- `Issue 1007 <https://pagure.io/koji/issue/1007>`_ --
+  decode_args() might result in --package parameter missing in runroot command
+
+- `Issue 150 <https://pagure.io/koji/issue/150>`_ --
+  no target info in channel policy for non-rpm tasks
+
+- `PR: 973 <https://pagure.io/koji/pull-request/973>`_ --
+  Check empty arches before spawning dist-repo
+
+- `Issue 958 <https://pagure.io/koji/issue/958>`_ --
+  Notification for tagBuildBypass is writing message untagged from, expected message tagged into
+
+- `Issue 968 <https://pagure.io/koji/issue/968>`_ --
+  Default enable python3 on RHEL8
+
+- `Issue 916 <https://pagure.io/koji/issue/916>`_ --
+  `clone-tag` doesn't preserve tagging order
+
+- `Issue 949 <https://pagure.io/koji/issue/949>`_ --
+  cli: [rpminfo] KeyError: 'license' for external RPM
+
+- `Issue 876 <https://pagure.io/koji/issue/876>`_ --
+  koji clone-tag raises "UnboundLocalError"
+
+- `Issue 945 <https://pagure.io/koji/issue/945>`_ --
+  Koji build fail due to ambiguous python shebang
+

