Date: Mon, 10 Nov 2008 09:17:51 -0600 From: "Will Drewry" <redpig@...rt.org> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...re.org>, "Chris Evans" <scarybeasts@...il.com> Subject: Re: CVE request - Python string expandtabs On Mon, Nov 10, 2008 at 3:54 AM, Jan Lieskovsky <jlieskov@...hat.com> wrote: > Hello Steve, > > could you allocate a new CVE id for the following Python issue: > > * Advisory: http://scary.beasts.org/security/CESA-2008-008.html > > * Issue: Integer overflow in string expandtabs operation > > * PoC: s = 't\tt\t' > str.expandtabs(s, 2147483647) > > Different issue than CVE-2008-2315 (CVE-2008-2315 mentions > patch: http://bugs.gentoo.org/attachment.cgi?id=159418&action=view > which is not sufficient to resolve this str_expandtabs issue). > > * Confirmation from Chris Evans: > > Adding in Will.... > > ... yes, this sounds accurate. Searching through my mail, my colleague > Will found that the original expandtabs() fix was insufficient (thanks > for the catch Will!). > > * Upstream patch: http://svn.python.org/view?rev=61350&view=rev This appears to be the patch for 2.6. The 2.5 maintenance patch was one revision earlier: http://svn.python.org/view?rev=61349&view=rev > * Affected Python versions: 2.2.3 <= x <= 2.5.1 Given that there is a patch for 2.6 as well, it might be worth expanding the impacted versions to include it. (I believe 2.5.2 was also affected where r61349 fixed it for 2.5.3.) For patch validation purposes, * string poc: s = 'AA\t\n\tAAAAAAAA' len(s.expandtabs(0x7ffffffe)) * unicode poc: s = u'AA\t\n\tAAAAAAAA' len(s.expandtabs(0x7ffffffe)) cheers, will
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.