[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2359eed20811100717i5f9bb22w913d0bfb8e9523aa@mail.gmail.com>
Date: Mon, 10 Nov 2008 09:17:51 -0600
From: "Will Drewry" <redpig@...rt.org>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...re.org>,
"Chris Evans" <scarybeasts@...il.com>
Subject: Re: CVE request - Python string expandtabs
On Mon, Nov 10, 2008 at 3:54 AM, Jan Lieskovsky <jlieskov@...hat.com> wrote:
> Hello Steve,
>
> could you allocate a new CVE id for the following Python issue:
>
> * Advisory: http://scary.beasts.org/security/CESA-2008-008.html
>
> * Issue: Integer overflow in string expandtabs operation
>
> * PoC: s = 't\tt\t'
> str.expandtabs(s, 2147483647)
>
> Different issue than CVE-2008-2315 (CVE-2008-2315 mentions
> patch: http://bugs.gentoo.org/attachment.cgi?id=159418&action=view
> which is not sufficient to resolve this str_expandtabs issue).
>
> * Confirmation from Chris Evans:
>
> Adding in Will....
>
> ... yes, this sounds accurate. Searching through my mail, my colleague
> Will found that the original expandtabs() fix was insufficient (thanks
> for the catch Will!).
>
> * Upstream patch: http://svn.python.org/view?rev=61350&view=rev
This appears to be the patch for 2.6. The 2.5 maintenance patch was
one revision earlier:
http://svn.python.org/view?rev=61349&view=rev
> * Affected Python versions: 2.2.3 <= x <= 2.5.1
Given that there is a patch for 2.6 as well, it might be worth
expanding the impacted versions to include it. (I believe 2.5.2 was
also affected where r61349 fixed it for 2.5.3.)
For patch validation purposes,
* string poc:
s = 'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))
* unicode poc:
s = u'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))
cheers, will
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
