|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2014-1838: python-logilab-common: multiple temporary file vulnerabilities | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Victor Pereira <vpereira> |
| Component: | Incidents | Assignee: | Dirk Mueller <dmueller> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | meissner, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | maint:released:sle11-sp3:56107 | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
The SWAMPID for this issue is 56094. This issue was rated as moderate. Please submit fixed packages until 2014-02-17. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. bugbot adjusting priority Update released for: python-logilab-common Products: SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SUSE-SU-2014:0301-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 861822 CVE References: CVE-2014-1838,CVE-2014-1839 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): python-logilab-common-0.56.2-1.9.1 openSUSE-SU-2014:0306-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 861822 CVE References: CVE-2014-1838,CVE-2014-1839 Sources used: openSUSE 13.1 (src): python-logilab-common-0.58.0-7.4.1 openSUSE 12.3 (src): python-logilab-common-0.58.0-4.4.1, python3-logilab-common-0.58.0-4.4.1 rekeased |
CVE-2014-1838 and CVE-2014-1839 Two vulnerabilities in python-logilab-common module were found. Both are related with temporary file handling. first one CVE-2014-1838: In logilab/common/pdf_ext.py it uses fully predictable names: def extract_keys_from_pdf(filename): # what about using 'pdftk filename dump_data_fields' and parsing the output ? os.system('pdftk %s generate_fdf output /tmp/toto.fdf' % filename) lines = file('/tmp/toto.fdf').readlines() return extract_keys(lines) def fill_pdf(infile, outfile, fields): write_fields(file('/tmp/toto.fdf', 'w'), fields) os.system('pdftk %s fill_form /tmp/toto.fdf output %s flatten' % (infile, outfile)) the second one CVE-2014-1839: in logilab/common/shellutils.py: class Execute: """This is a deadlock safe version of popen2 (no stdin), that returns an object with errorlevel, out and err. """ def __init__(self, command): outfile = tempfile.mktemp() errfile = tempfile.mktemp() self.status = os.system("( %s ) >%s 2>%s" % (command, outfile, errfile)) >> 8 self.out = open(outfile, "r").read() self.err = open(errfile, "r").read() os.remove(outfile) os.remove(errfile) tempfile.mktemp() should be replaced with tempfile.mkstemp(). References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051 https://bugs.gentoo.org/show_bug.cgi?id=499872 https://bugzilla.redhat.com/show_bug.cgi?id=1060304 http://secunia.com/advisories/56720/ http://comments.gmane.org/gmane.comp.security.oss.general/11986