oss-security - Re: CVE Request - Python string expandtabs

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 5 Nov 2008 11:27:16 -0800
From: "Chris Evans" <scarybeasts@...il.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...re.org>, "Will Drewry" <redpig@...rt.org>
Subject: Re: CVE Request - Python string expandtabs

Adding in Will....

... yes, this sounds accurate. Searching through my mail, my colleague
Will found that the original expandtabs() fix was insufficient (thanks
for the catch Will!).

On Wed, Nov 5, 2008 at 3:10 AM, Jan Lieskovsky <jlieskov@...hat.com> wrote:
> Hello!
>
>  yesterday looked yet at the Python issues reported
> by Chris Evans at:
>
> http://scary.beasts.org/security/CESA-2008-008.html
>
> and found out, the issue:
>
> * Integer overflow in string expandtabs operation
>
> *  PoC: s = 't\tt\t'
>        str.expandtabs(s, 2147483647)
>
>  still lacks its own separate CVE identifier.
>
>  Different issue than CVE-2008-2315.
>
>  Reasoning:
>  =========
>
>  Integer overflows in stringobject.c and unicodeobject.c
>  in Python 2.5.2 are part of CVE-2008-2315, but
>  part of CVE-2008-2315 is also mention about patch:
>
>  http://bugs.gentoo.org/attachment.cgi?id=159418&action=view
>
>  which by itself is not sufficient to resolve this flaw.
>
>  Upstream has applied the following patch:
>  =========================================
>
>  http://svn.python.org/view?rev=61350&view=rev
>
>  Have checked by above PoC that applying this patch
>  solves this vulnerability.
>
>  Affected Python versions: 2.2.3 <= x <= 2.5.1
>  =========================
>
> Chris, can you confirm my investigation?
>
> Steve, could you allocate a new CVE id?
>
> Thanks, Jan.
>
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
>
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.