Date: Tue, 27 Mar 2012 09:59:46 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Vincent Danen <vdanen@...hat.com> Subject: Re: CVE request: distutils creates ~/.pypirc insecurely On 03/27/2012 08:15 AM, Vincent Danen wrote: > Standard flaw where a file that contains a username and password is > written with insecure permissions. This only affects python 2.6 and > higher. > > Could a CVE name be assigned to this flaw? I don't think one has been > already. > > References: > > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650555 > https://bugzilla.redhat.com/show_bug.cgi?id=758905 > http://bugs.python.org/issue13512 > http://bugs.python.org/file23824/pypirc-secure.diff > > Thanks. > Please use CVE-2012-1587 for this issue. -- Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ