oss-security - Re: Issue with PYTHON_EGG

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 15 Dec 2013 14:47:12 -0500 (EST)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, gmurphy@...hat.com
Subject: Re: Issue with PYTHON_EGG_CACHE

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> OpenStack swift:

> os.environ['PYTHON_EGG_CACHE'] = '/tmp'

This message seems to disclose a vulnerability in an unspecified
version of OpenStack Swift. It might be the same as this part of the
http://tarballs.openstack.org/swift/swift-1.11.0.tar.gz distribution:

swift/common/manager.py

  def setup_env():
  ...
  os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')

http://git.openstack.org/cgit/openstack/swift/tree/swift/common/manager.py

http://www.openstack.org/projects/openstack-security/ says "How to
Report Security Issues to OpenStack ... Open a bug in Launchpad and
mark it as a 'security bug'. This will make the bug Private and only
accessible to the Vulnerability Management Team." We don't know
whether that has been done. It may be inapplicable because the
information isn't private.

Use CVE-2013-7109 for this report about OpenStack Swift. Again,
CVE-2013-7109 is not an ID for which setuptools is the affected
product.

> Google search:
> 
> PYTHON_EGG_CACHE "/tmp" filetype:py

This seems very useful, but it's not a type of information that MITRE
is interested in working with at this exact moment. At first glance,
the Google search results seem to include all of the following:

  - cases in which something equivalent to
    "os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')" is used within
    code that's intended for distribution as a "product"

  - cases in which something equivalent to
    "os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')" is used within
    other types of code such as site-specific code or example code

  - cases in which setting PYTHON_EGG_CACHE would not actually occur
    (comments, documentation, discussion, etc.)

We can assign CVE IDs for the first category, i.e., cases in which
someone has identified this as a security problem within a specific
software product.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSrgaXAAoJEKllVAevmvmsaf4IAKucJyDDjHoKlexqpH2lk2iZ
sArZ3BXydRbvwSsQYiwB6gh/0ncqjszaE4fqcoPLSdG1s9FTHaIwQWAdbVBNYlwM
CPuRj4iQbce5D8+PBIgnbF051W/vIDnJAgcE67FfVG0gX1DbOCR/UHkiy6kgrlt8
r92uO2KQ7DtJ68g6xf4N0iHiF5wM4IAbIRAvx4ia7Qj6mdYdXWbLRQnDP4qfeSnJ
X0qzn9eVIutWp1VM3+dIarGUOeaRCV8yOvWPz2nt3HGrCMMWEiZhecUUBIUqPLrN
orLeQuU1u1qi72kaYldWKbT9/4SZgjKHs2QkuUcghMyY5vaYNwXbN8IbmHdseqk=
=e156
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.