Mailman 3 January 2004 - Python-announce-list

ANNOUNCE: Zope 2.6.3 Release and Security Update
by Brian Lloyd Jan. 8, 2004

Jan. 8, 2004

Zope 2.6.3 Release and Security Update Zope 2.6.3 contains a number of security related fixes for issues resolved during a comprehensive security audit conducted in Q4 2003. You may download Zope 2.6.3 from Zope.org: http://www.zope.org/Products/Zope/2.6.3/ **Users of the VerboseSecurity add-on product for Zope please note:** some of the security-related changes in Zope 2.6.3 are incompatible with the VerboseSecurity product. Please uninstall the VerboseSecurity product before upgrading to 2.6.3 to avoid problems. It is expected that VerboseSecurity will be updated to be compatible with Zope 2.6.3 in the near future. Also note that there are binary code changes in the 2.6.3 release, making it impossible to issue an external "hotfix" to resolve these issues. CVS users should be sure to update their sites **and rebuild the C Python extensions** to ensure that all fixes are deployed. In the fourth quarter of 2003, a comprehensive evaluation of the changes to Python from version 2.1 to 2.3.3 was undertaken. This evaluation was designed to assess each change to the Python environment in terms of its potential impact on the Zope application server and Zope applications, with the goal of making Python 2.3.3 the required Python platform for Zope beginning with Zope 2.7. The evaluation was focused on assessing changes to Python in the following contexts: - Changes that would have compatibility or other effects on existing or new Zope applications - Changes that could potentially affect the Zope security architecture or change the behavior of the restricted execution environment used by Zope to run untrusted code In the course of the evaluation, very few of the Python changes in 2.3.3 directly affected the Zope security architecture or had impacts on the restricted execution model. However, a number of pre-existing potential issues were discovered and resolved in the course of the comprehensive security audit that was performed as a part of the Python upgrade evaluation. Zope 2.6.3 provides fixes for all of these issues. A description of each issue, who is affected and issue status is included below. For more information on what is new in this release, see the CHANGES.txt and HISTORY.txt files for the release: - http://www.zope.org/Products/Zope/2.6.3/CHANGES.txt - http://www.zope.org/Products/Zope/2.6.3/HISTORY.txt For more information on the available Zope releases, guidance for selecting the right distribution and installation instructions, please see: http://www.zope.org/Documentation/Misc/InstallingZope.html ISSUES RESOLVED BY Zope 2.6.3: - For loops, list comprehensions, and other iterations in untrusted code Issue Description Iteration over sequences could in some cases fail to check access to an object obtained from the sequence. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - List and dictionary instance methods in untrusted code Issue Description List and dictionary instance methods such as the get method of dictionary objects were not security aware and could return an object without checking access to that object. Subsequent checks (such as for attributes access) of such an object would still be performed, but it should not have been possible to obtain the object in the first place. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of import as in untrusted code Issue Description Use of "import as" in Python scripts could potentially rebind names in ways that could be used to avoid appropriate security checks. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Use of min, max, enumerate, iter, and sum in untrusted code Issue Description A number of newer built-ins were either unavailable in untrusted code or did not perform adequate security checking. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Broken binding validation in untrusted code Issue Description The variables bound to page templates and Python scripts such as "context" and "container" were not checked adequately, allowing a script to potentially access those objects without ensuring the necessary permissions on the part of the executing user. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unpacking in untrusted code Issue Description Unpacking via function calls, variable assignment, exception variables and other contexts did not perform adequate security checks, potentially allowing access to objects that should have been protected. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Unicode passed to RESPONSE.write() could shutdown process Issue Description Inadequate type checking could allow unicode values passed to RESPONSE.write() to be passed into deeper layers of asyncore, where an exception would eventually be generated at a level that would cause the Zserver main loop to terminate. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PythonScript class security not initialized properly Issue Description Class security was not properly intialized for PythonScripts, potentially allowing access to variables that should be protected. It turned out that most of the security assertions were in fact activated as a side effect of other code, but this fix is still appropriate to ensure that all security declarations are properly applied. Who Is Affected? Sites that use Python Scripts. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - XML-RPC instance marshaling may disclose protected values Issue Description XML-RPC marshalling of class instances used the instance __dict__ to marshal the object, and could include attributes prefixed with an underscore name. These attributes are considered private in Zope and should generally not be disclosed. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - DTML tag dtml-tree may allow DoS attack Issue Description The dtml-tree tag used an "eval" of user-supplied data; its efforts to prevent abuse were ineffective. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Potential cross-site scripting problem in default ZSearch interface Issue Description Browsers that do not escape html in query strings such as Internet Explorer 5.5 could potentially send a script tag in a query string to the ZSearch interface for cross-site scripting. Who Is Affected? Sites that use the default ZSearch interface. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Proxy rights on DTMLMethods transferred via acquisition Issue Description DTMLMethods with proxy rights could incorrectly transfer those rights via acquisition when traversing to a parent object. Who Is Affected? Sites that allow users who have increased permissions in subfolders to write DTMLMethods. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Improper security assertions on DTMLDocument objects Issue Description Some improper security assertions on DTMLDocument objects could potentially allow access to members that should be protected. Who Is Affected? Sites that use DTMLDocuments for secure content. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - PropertyManager 'lines' and 'tokens' properties stored as list Issue Description Some property types were stored in a mutable data type (list) which could potentially allow untrusted code to effect changes on those properties without going through appropriate security checks in particular scenarios. Who Is Affected? Sites that allow untrusted users to write Python Scripts, Page Templates, and DTML. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Inadequate security assertions on admin "find" functions Issue Description Inadequate security assertions on administrative "find" methods could potentially be abused. Who Is Affected? All Zope sites. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - ZTUtils.SimpleTree state handling Issue Description The ZTUtils SimpleTree decompressed tree state data from the request without checking for final size, which could allow for certain types of DoS attacks. Who Is Affected? Sites that rely on the ZTUtils.SimpleTree. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher. Affected sites are strongly encouraged to update their Zope installations to prevent this issue. - Configuration file did not override security policy selection Issue Description This is not really a security issue, just a usability issue. It has always been possible to alternate between C and Python implemenations of the Zope security policy using certain environment variables. As of Zope 2.7, use of environment variables is deprecated in favor of the new 2.7 configuration files. The new configuration machinery was not implementing the directive used to override the default security policy. Who Is Affected? Zope 2.7 beta users. Resolution This issue is resolved in Zope 2.6.3 and Zope 2.7.0 beta 4 and higher.

1 0

New mailing list: freebsd-python
by Hye-Shik Chang Jan. 8, 2004

Jan. 8, 2004

Hello, Python buddies! The freebsd-python mailing is just created. This list is for discussions related to porting Python, its 3rd party modules and Zope stuff to FreeBSD. And any related topics are welcome. If you are interested in FreeBSD Python ports, it's time to enter the list. ;) http://lists.freebsd.org/mailman/listinfo/freebsd-python Regards, Hye-Shik

1 0

ANNOUNCE: MozPython 0.1.0 released
by Thomas Schilz Jan. 8, 2004

Jan. 8, 2004

MozPython version 0.1.0 has been released today. MozPython embeds the Python interpreter in Mozilla. With MozPython you can execute Python scripts in Mozilla. Script output to sys.stdout is displayed in the browser window. MozPython may for example be useful for you if you have written a Web application with Python CGI scripts. You can now have your application run offline in Mozilla without the need for a local Web server. If PyXPCOM is installed on your system then MozPython gives your scripts access to the browser window they are executing in. This might be useful if you are more interested in creating pure offline applications using Mozilla and Python. For more information about MozPython and to download the current version go to the MozPython home page at http://www.thomas-schilz.de/MozPython <p><a href="http://www.thomas-schilz.de/MozPython">MozPython 0.1.0</a> Embedding the Python interpreter in Mozilla. (08-01-04)

1 0

RPy library now available for R version 1.8.X
by Warnes, Gregory R Jan. 8, 2004

Jan. 8, 2004

I've created a modified version of Walter Moriera's RPy[1] library for using the open-source statistical package R[2] from within Python[3]. RPy is a very simple, yet robust, Python interface to the R Programming Language (http://www.r-project.org). It can manage all kinds of R objects and can execute arbitrary R functions (including the graphic functions). All the errors from the R language are converted to Python exceptions. Any module that later were installed on the R system, can easily be used from within Python, without introducing any changes. My Unix and Windows versions of RPy are available from http://www.warnes.net/rpy and are compatible with the latest releases of R, including 1.8.1. I've also done some work done on merging the Unix and Windows versions into a single code tree. Please contact me directly with any questions or concerns. Gregory R. Warnes, Ph.D. Senior Coordinator Groton Non-Clinical Statistics Pfizer Global Research and Development [1] http://rpy.sf.net [2] http://www.r-project.org [3] http://www.python.org LEGAL NOTICE Unless expressly stated otherwise, this message is confidential and may be privileged. It is intended for the addressee(s) only. Access to this E-mail by anyone else is unauthorized. If you are not an addressee, any disclosure or copying of the contents of this E-mail or any action taken (or not taken) in reliance on it is unauthorized and may be unlawful. If you are not an addressee, please inform the sender immediately.

1 0

ZODB3 3.3 alpha 2 released
by Jeremy Hylton Jan. 6, 2004

Jan. 6, 2004

I'm pleased to announce the release of ZODB2 3.3 alpha 2. This release includes support for new-style persistent classes and multi-version concurrency control. It's an alpha release, so we could use feedback on the new features and helping testing them. The 3.3a2 release requires Python 2.3. It contains the code that is slated to be in Zope 2.8. You can download a source tarball or Windows installer from http://zope.org/Products/ZODB3.3 The new features represent major changes to ZODB. Support for new-style classes means that ZODB programmers can use the new class features introduced in Python 2.2, like properties and descriptors. It also means that ZODB no longer uses ExtensionClass, which caused many subtle incompatibilities with other classes. The multi-version concurrency control feature represents the end of read conflicts. If a transaction encounters a conflict, it reads older revisions of the object rather than raising a ReadConflictError. This feature allows read-only transactions to see a consistent view of the database without need to handle read conflicts and restart the transaction. The code is fairly stable, but we have noted a few hard-to-provoke bugs during development. One problem is a refcount problem in the persistence core that causes rare core dumps in Python's garbage collector. (Rare means once a week across multiple developers and testers.) We hope to move to a beta release expeditiously, perhaps as early as next month. The final release schedule depends on the Zope 2.8 release schedule. More on that later. Enjoy! -- Jeremy Hylton <http://www.python.org/~jeremy/>

1 0

[ANN]New project: PyCrash
by Carmine Noviello Jan. 6, 2004

Jan. 6, 2004

The project Im going to present is a Python module, named PyCrash, which can be very useful in exploiting bugs of Python written programs. PyCrash is a crash handler that handles uncaught exception during program execution and collects information about the program context. PyCrash can be very useful in report bug information, because the programmer can easily analyse the program execution context of the crashed application. Major information collected by PyCrash in the crash dump is: - Information about operating system, Python and Python Standard Library version and general information about the program that is crashed (e.g., program name and version, time at witch program started and ended, and so on); - Information about the uncaught exception, like the exception type, the context (namely method name) in which the exception occurred and the exception value; - General information about variables state; - Information about the stack of each thread, like the list of stack frames, the variables value in each stack frame, and so on; - General information about source code, like variable and function position in source file that can be useful for the programmer to find quickly bugs in source tree; The format of the crash dump file generated by PyCrash is XML, so the programmer can easily read this file to understand why the program is crashed. Currently, PyCrash needs Python 2.3 or higher. Actually, PyCrash is still in beta, and the latest version is 0.2-beta2. Im also working to a graphical tool, named PyCrashViewer, that shows PyCrash core file in a graphical manner, so the user can quickly and easily exploits bugs. You can see a screenshot at: http://pycrash.sourceforge.net/images/shot.png For further information, please visit PyCrash home page at http://pycrash.sourceforge.net Thanks in advance to who will send me comments and suggests about this project. Carmine I.D. Noviello -- Posted via Mailgate.ORG Server - http://www.Mailgate.ORG

1 0

ANN: ClientCookie 0.4.18 and 0.9.3a released (and mechanize 0.0.5a)
by jjl＠pobox.com Jan. 5, 2004

Jan. 5, 2004

http://wwwsearch.sourceforge.net/ClientCookie/ (I've uploaded a new version of mechanize too -- a lot of minor bugfixes; note that ClientCookie 0.4.17 or newer is now required by mechanize) 0.4.18 is a stable bugfix release. 0.9.3a is an alpha release of a final version, parts of which I hope to get into Python 2.4. Changes from 0.4.14 to 0.4.18: * Fixed proxy handling. * Fixed redirection yet again. This time, the problem was that the state introduced by cookies makes it possible for redirection to occur to the same URL multiple times without an infinite loop occurring (regardless of redirection code). Should have thought of that before... * Fixed several bugs relating to request verifiability. * Worked around cases where multiple headers are (incorrectly) returned by server ("Location" in particular). * Fixes for mechanize module, to the response_seek_wrapper class. * Other minor bug fixes. Changes from 0.9.0a to 0.9.3a (development version): * unverifiable and origin_req_host are now attributes initialised by Request.__init__(). All arguments named unverifiable are now gone. * Renamed Request.iter_headers() to .header_items(). * Bugfixes, as for stable version. Requires Python >= 1.5.2. ClientCookie is a Python module for handling HTTP cookies on the client side, useful for accessing web sites that require cookies to be set and then returned later. It also provides some other (optional) useful stuff: HTTP-EQUIV and Refresh handling, automatic adding of the Referer [sic] header and lazily-seek()able responses. These extras are implemented using an extension that makes it easier to add new functionality to urllib2. It has developed from a port of Gisle Aas' Perl module HTTP::Cookies, from the libwww-perl library. Simple usage: import ClientCookie response = ClientCookie.urlopen("http://www.example.com/") This function behaves identically to urllib2.urlopen, except that it deals with cookies automatically. That's probably all you need to know. John

1 0

PyCon Reminder: Proposal deadline 1/15
by Guido van Rossum Jan. 5, 2004

Jan. 5, 2004

This is a reminder that the deadline for sending proposals for presentations at PyCon DC 2004 is January 15, 2004. We are interested in any and all submissions about uses of Python and the development of the language. Since there is expected to be a strong educational community presence for the next PyCon, teaching materials of various kinds are also encouraged. You can submit your proposal at: http://submit.pycon.org/ For more information about proposals, see: http://www.pycon.org/dc2004/cfp/ If you have further questions about the submission web interface or the format of submissions, please write to: pycon-organizers(a)python.org We would like to publish all accepted papers on the web. If your paper is accepted and you prepare an electronic presentation (in PDF, PythonPoint or PowerPoint) we will also happily publish that on the web site once PyCon is over. If you don't want to make a formal presentation, there will be a significant amount of Open Space to allow for informal and spur-of-the-moment presentations for which no formal submission is required. There will also be several Lightning Talk sessions (five minutes or less). About PyCon: PyCon is a community-oriented conference targeting developers (both those using Python and those working on the Python project). It gives you opportunities to learn about significant advances in the Python development community, to participate in a programming sprint with some of the leading minds in the Open Source community, and to meet fellow developers from around the world. The organizers work to make the conference affordable and accessible to all. PyCon DC 2004 will be held March 24-26, 2004 in Washington, D.C. The keynote speaker is Mitch Kapor of the Open Source Applications Foundation (http://www.osafoundation.org/). There will be a four-day development sprint before the conference. We're looking for volunteers to help run PyCon. If you're interested, subscribe to http://mail.python.org/mailman/listinfo/pycon-organizers Don't miss any PyCon announcements! Subscribe to http://mail.python.org/mailman/listinfo/pycon-announce You can discuss PyCon with other interested people by subscribing to http://mail.python.org/mailman/listinfo/pycon-interest The central resource for PyCon DC 2004 is http://www.pycon.org/ Pictures from last year's PyCon: http://www.python.org/cgi-bin/moinmoin/PyConPhotos I'm looking forward to seeing you all in DC in March!!! --Guido van Rossum (home page: http://www.python.org/~guido/)

1 0

REMINDER: BayPIGgies Jan 8: Python Threads
by Aahz Jan. 5, 2004

Jan. 5, 2004

The next BayPIGgies meeting is this Thursday, January 8, 2004, 7:30pm Aahz will be presenting a talk on Python threads. BayPIGgies meetings are held at Stanford, California. For more information, see http://www.baypiggies.net/ -- Aahz (aahz(a)pythoncraft.com) <*> http://www.pythoncraft.com/ A: No. Q: Is top-posting okay?

1 0

ANN: Anonfunc 1.0
by Hye-Shik Chang Jan. 3, 2004

Jan. 3, 2004

Hello! Anonfunc module is a C extension module provides very simple proxy object that creates anonymous functions based on they got operated. See the demo: (X, Y, Z is provided to builtins from anonfunc automatically.) >>> f = X + Y * Z >>> f(1, 2, 3) 7 >>> f = divmod(X ** 3 + X ** 2, 5) >>> f(12) (374, 2) >>> f = X[:5] + Y[-5:] >>> f(range(10), range(20)) [0, 1, 2, 3, 4, 15, 16, 17, 18, 19] >>> f1 = X ** 3 + 3 * (X ** 2) >>> f2 = X + Y % X >>> (f1 * f2)(3, 4) 216 >>> import sys >>> f = anonfunc('mod').platform >>> f(mod=sys) 'freebsd5' But you can't use it with complete set of python operators because anonfunc implementation is just based on operator overloadings. Use it after you know what really it is. :) You can download it from http://www.freebsd.org/cgi/pds.cgi?ports/devel/py-anonfunc Thank you! Regards, Hye-Shik

1 0