[Patches] [ python-Patches-590294 ] os._execvpe security fix

[noreply@sourceforge.net]

Patches item #590294, was opened at 2002-08-02 11:21
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=590294&group_id=5470

Category: Modules
Group: Python 2.3
Status: Open
Resolution: None
Priority: 5
Submitted By: Zack Weinberg (zackw)
Assigned to: Nobody/Anonymous (nobody)
Summary: os._execvpe security fix

Initial Comment:
1) Do not attempt to exec a file which does not exist
just to find out what error the operating system
returns.  This is an exploitable race on all platforms
that support symbolic links.

2) Immediately re-raise the exception if we get an
error other than errno.ENOENT or errno.ENOTDIR.  This
may need to be adapted for other platforms.

(As a security issue, this should be considered for 2.1
and 2.2 as well as 2.3.)


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=590294&group_id=5470