[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <BFC437B0-40E5-436B-800C-83F5E558BD6D@stufft.io>
Date: Mon, 11 Mar 2013 15:32:52 -0400
From: Donald Stufft <donald@...fft.io>
To: oss-security@...ts.openwall.com
Subject: CVE Request: MD5 used for Download verification
I'd like to request CVE(s?) for the Python software: setuptools[1] and distribute[2]
Setuptools (and it's fork distribute) utilize MD5 in order to verify that a download has not been tampered with.
As far as I know this affects all versions of both setuptools and distribute.
It also affects zc.buildout[3] which utilizes the md5 checking from distribute. It does not affect pip[4] as pip has grown it's own handling code outside of setuptools/distribute to allow stronger hashes.
[1] https://pypi.python.org/pypi/setuptools/0.6c11
[2] https://pypi.python.org/pypi/distribute/0.6.35
[3] https://pypi.python.org/pypi/zc.buildout/2.0.1
[4] https://pypi.python.org/pypi/pip/1.3.1
-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
Download attachment "signature.asc" of type "application/pgp-signature" (842 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
