Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 10 Nov 2008 09:17:51 -0600
From: "Will Drewry" <redpig@...rt.org>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...re.org>, 
	"Chris Evans" <scarybeasts@...il.com>
Subject: Re: CVE request - Python string expandtabs

On Mon, Nov 10, 2008 at 3:54 AM, Jan Lieskovsky <jlieskov@...hat.com> wrote:
> Hello Steve,
>
>  could you allocate a new CVE id for the following Python issue:
>
> * Advisory: http://scary.beasts.org/security/CESA-2008-008.html
>
> * Issue: Integer overflow in string expandtabs operation
>
> * PoC: s = 't\tt\t'
>       str.expandtabs(s, 2147483647)
>
>  Different issue than CVE-2008-2315 (CVE-2008-2315 mentions
>  patch: http://bugs.gentoo.org/attachment.cgi?id=159418&action=view
>  which is not sufficient to resolve this str_expandtabs issue).
>
> * Confirmation from Chris Evans:
>
>  Adding in Will....
>
>  ... yes, this sounds accurate. Searching through my mail, my colleague
>  Will found that the original expandtabs() fix was insufficient (thanks
>  for the catch Will!).
>
> * Upstream patch: http://svn.python.org/view?rev=61350&view=rev

This appears to be the patch for 2.6.  The 2.5 maintenance patch was
one revision earlier:
  http://svn.python.org/view?rev=61349&view=rev

> * Affected Python versions: 2.2.3 <= x <= 2.5.1

Given that there is a patch for 2.6 as well, it might be worth
expanding the impacted versions to include it.  (I believe 2.5.2 was
also affected where r61349 fixed it for 2.5.3.)

For patch validation purposes,
* string poc:
s = 'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))

* unicode poc:
s = u'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))


cheers, will

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.