[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <497475886.29391584.1372343485338.JavaMail.root@redhat.com>
Date: Thu, 27 Jun 2013 10:31:25 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
Ralph Loader <suckfish@...g.co.nz>
Subject: CVE Request -- python-suds: Insecure temporary directory use when
initializing file-based URL cache
Hello Kurt, Steve, vendors,
based on the public Red Hat Bugzilla report:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=978696
by Ralph Loader:
A insecure temporary directory use flaw was found in the way
python-suds, a Python SOAP web services client library, performed
initialization of its internal file-based URL cache (predictable
location was used for directory to store the cached files). A
local attacker could use this flaw to conduct symbolic link
attacks, possibly leading to their ability for example the
SOAP .wsdl metadata to redirect queries to a different host,
than originally intended.
The reasons for the current behaviour are detailed at:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=978696#c4
Could you allocate a CVE id for this?
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
P.S.: There doesn't seem to be an upstream patch available yet (afaik),
but the fix is obvious - use more unpredictable routine
for file-based URL cache directory location generation than
Python's tempfile.gettempdir() (which is case tempfile.tempdir
is None, defaults to '/tmp').
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
