Date: Mon, 11 Mar 2013 15:32:52 -0400 From: Donald Stufft <donald@...fft.io> To: oss-security@...ts.openwall.com Subject: CVE Request: MD5 used for Download verification I'd like to request CVE(s?) for the Python software: setuptools and distribute Setuptools (and it's fork distribute) utilize MD5 in order to verify that a download has not been tampered with. As far as I know this affects all versions of both setuptools and distribute. It also affects zc.buildout which utilizes the md5 checking from distribute. It does not affect pip as pip has grown it's own handling code outside of setuptools/distribute to allow stronger hashes.  https://pypi.python.org/pypi/setuptools/0.6c11  https://pypi.python.org/pypi/distribute/0.6.35  https://pypi.python.org/pypi/zc.buildout/2.0.1  https://pypi.python.org/pypi/pip/1.3.1 ----------------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA Download attachment "signature.asc" of type "application/pgp-signature" (842 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.