Mailman 3 March 2017 - Security-SIG

Python Vulnerabilities: Vulnerable Python versions added
by Victor Stinner March 23, 2017

March 23, 2017

Hi, I just added the list of vulnerable Python versions to my report: http://python-security.readthedocs.io/vulnerabilities.html So I checked the status of backports, and I identified one last vulnerability not fixed in Python 3.4 yet: HTTP directory traversal on Windows. I proposed a cherry-pick: https://github.com/python/cpython/pull/782 Python 3.2 and 3.3 lack a lot of fixes, but the last release was in 2014. Fixes were backported in the meanwhile, but no new security version was … [View More]

1 0

Archives (.tar or .zip) with absolute paths
by Victor Stinner March 10, 2017

March 10, 2017

Hi, I noticed that "python3 -m tarfile -x archive.tar" uses absolute paths by default, whereas the UNIX tar command doesn't by default. The UNIX tar command requires to add explicitly --absolute-paths (-P) option. The tarfile and zipfile modules (maybe also some others, I didn't check) contain warnings absolute paths and paths containing "..". Why not ignoring "/" at start of filenames *by default*? By backward compatibility? I suggest to add a boolean absolute_path option to tarfile and … [View More]

3 7

New report of Python vulnerabilities
by Victor Stinner March 10, 2017

March 10, 2017

Hi, I made major enhancements in my tool to generate reports on Python vulnerabilities. * A timeline is now automatically generated using the different dates: initial report date, disclosure date, commits, Python releases, etc. * CVE details are now downloaded automatically, so it's not more filled manually in the YAML file. * Each vulnerability has now its own page Good example showing everything altogether, the Sweet32 attack: http://python-security.readthedocs.io/vuln/cve-2016-… [View More]

1 0

HTML page of Python security vulnerabilities
by Victor Stinner March 10, 2017

March 10, 2017

Hi, I wrote a tool to generate an HTML report on Python security vulnerabilities. It takes the following YAML file as input: https://github.com/haypo/python-security/blob/master/vulnerabilities.yml And Python release dates, file written manually from Misc/NEWS: https://github.com/haypo/python-security/blob/master/python_releases.txt The output is the HTML page: http://python-security.readthedocs.io/en/latest/vulnerabilities.html For each vulnerability, you have a description and a list of … [View More]

3 6

Patching ssl.py to workaround ssl lack of relocability
by David Cournapeau March 2, 2017

March 2, 2017

Hi there, This is hopefully the right mailing for this question. We are shipping our own python interpreter in our product, and following some discussions on https://mail.python.org/pipermail/python-dev/2017-January/147282.html, we understand shipping the certificate from certifi in our python is the best approach on Linux/OS X. Unfortunately, ssl hardcodes at compilation time the default location of certificate. I could workaround this at the python level by patching ssl.SSLContext.… [View More]

3 4