Date: Sun, 15 Dec 2013 14:47:12 -0500 (EST) From: cve-assign@...re.org To: kseifried@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, gmurphy@...hat.com Subject: Re: Issue with PYTHON_EGG_CACHE -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > OpenStack swift: > os.environ['PYTHON_EGG_CACHE'] = '/tmp' This message seems to disclose a vulnerability in an unspecified version of OpenStack Swift. It might be the same as this part of the http://tarballs.openstack.org/swift/swift-1.11.0.tar.gz distribution: swift/common/manager.py def setup_env(): ... os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp') http://git.openstack.org/cgit/openstack/swift/tree/swift/common/manager.py http://www.openstack.org/projects/openstack-security/ says "How to Report Security Issues to OpenStack ... Open a bug in Launchpad and mark it as a 'security bug'. This will make the bug Private and only accessible to the Vulnerability Management Team." We don't know whether that has been done. It may be inapplicable because the information isn't private. Use CVE-2013-7109 for this report about OpenStack Swift. Again, CVE-2013-7109 is not an ID for which setuptools is the affected product. > Google search: > > PYTHON_EGG_CACHE "/tmp" filetype:py This seems very useful, but it's not a type of information that MITRE is interested in working with at this exact moment. At first glance, the Google search results seem to include all of the following: - cases in which something equivalent to "os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')" is used within code that's intended for distribution as a "product" - cases in which something equivalent to "os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')" is used within other types of code such as site-specific code or example code - cases in which setting PYTHON_EGG_CACHE would not actually occur (comments, documentation, discussion, etc.) We can assign CVE IDs for the first category, i.e., cases in which someone has identified this as a security problem within a specific software product. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSrgaXAAoJEKllVAevmvmsaf4IAKucJyDDjHoKlexqpH2lk2iZ sArZ3BXydRbvwSsQYiwB6gh/0ncqjszaE4fqcoPLSdG1s9FTHaIwQWAdbVBNYlwM CPuRj4iQbce5D8+PBIgnbF051W/vIDnJAgcE67FfVG0gX1DbOCR/UHkiy6kgrlt8 r92uO2KQ7DtJ68g6xf4N0iHiF5wM4IAbIRAvx4ia7Qj6mdYdXWbLRQnDP4qfeSnJ X0qzn9eVIutWp1VM3+dIarGUOeaRCV8yOvWPz2nt3HGrCMMWEiZhecUUBIUqPLrN orLeQuU1u1qi72kaYldWKbT9/4SZgjKHs2QkuUcghMyY5vaYNwXbN8IbmHdseqk= =e156 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.