[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Sep 2014 03:17:03 -0400
From: Donald Stufft <donald@...fft.io>
To: oss-security@...ts.openwall.com
Subject: Re: pinocchio tmp vuln
> On Sep 9, 2014, at 11:38 AM, Kurt Seifried <kseifried@...hat.com> wrote:
>
>
>
> On 09/09/14 02:34 AM, Steve Kemp wrote:
>>> I have to say I don't understand at all why someone would be going
>>> through random packages from PyPi (especially test automation related)
>>> and searching for possible security issues.
>>
>> Because although the chances of them being exploited are low they
>> are genuine issues which have security implications.
>>
>> There is copious documentation online about how file races are
>> bad, including this quick reference:
>>
>> https://www.securecoding.cert.org/confluence/display/seccode/FIO21-C.+Do+not+create+temporary+files+in+shared+directories
>>
>> PyPi? 've no idea why that was chosen, but I expect because it
>> is a large mass of code that has had little similar attention paid
>> to it in the past. node.js will probably be next, I'm sure lots of
>> modules exist created by inexperienced developers who haven't
>> considered the implications of posting new code libraries.
>
> Actually one reason I picked PyPI is simply because it has
> popularity/usage info, each package web page says how many times it was
> downloaded in the last day/week/month, so I picked a quick an easy audit
> of packages downloaded more than 5000 times in the last month.
If there’s anything PyPI can do to help make looking for security bugs on
stuff hosted on PyPI easier just shoot me an email. I’m an admin there.
---
Donald Stufft
PGP: 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
