Via HackerOne. A researcher correctly reports that our install scripts use HTTP, not HTTPS, to fetch resources and execute them as root, which is a potentially significant vulnerability.
Instead, use HTTPS.
Details
Details
- Reviewers
chad - Commits
- rP2d7abfd9fa9a: Use HTTPS, not HTTP, in install scripts
Verified that these URIs function correctly over HTTPS.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Branch
- https1
- Lint
Lint Warnings Severity Location Code Message Warning scripts/install/install_rhel-derivs.sh:70 TXT3 Line Too Long - Unit
No Test Coverage - Build Status
Buildable 14700 Build 19205: Run Core Tests Build 19204: arc lint + arc unit