Your message dated Tue, 23 Feb 2010 20:14:15 +0000
with message-id <e1nk195-0006kc...@ries.debian.org>
and subject line Bug#560913: fixed in python2.5 2.5-5+etch2
has caused the Debian Bug report #560913,
regarding CVE-2009-3560 and CVE-2009-3720 denial-of-services
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
560913: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560913
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
package: python2.4
severity: serious
tags: security
Hi,
The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat. I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.
CVE-2009-3560[0]:
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720[1]:
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
| CVE-2009-2625.
These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected. This is a low-severity security
issue, so DSAs will not be issued to correct these problems. However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases. If you plan to do this,
please open new bugs and include the security tag so we are aware that
you are working on that.
For further information see [0],[1],[2],[3]. In particular, [2] and [3]
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
http://security-tracker.debian.org/tracker/CVE-2009-3560
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
http://security-tracker.debian.org/tracker/CVE-2009-3720
[2]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
[3]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
--- End Message ---
--- Begin Message ---
Source: python2.5
Source-Version: 2.5-5+etch2
We believe that the bug you reported is fixed in the latest version of
python2.5, which is due to be installed in the Debian FTP archive:
idle-python2.5_2.5-5+etch2_all.deb
to main/p/python2.5/idle-python2.5_2.5-5+etch2_all.deb
python2.5-dbg_2.5-5+etch2_i386.deb
to main/p/python2.5/python2.5-dbg_2.5-5+etch2_i386.deb
python2.5-dev_2.5-5+etch2_i386.deb
to main/p/python2.5/python2.5-dev_2.5-5+etch2_i386.deb
python2.5-examples_2.5-5+etch2_all.deb
to main/p/python2.5/python2.5-examples_2.5-5+etch2_all.deb
python2.5-minimal_2.5-5+etch2_i386.deb
to main/p/python2.5/python2.5-minimal_2.5-5+etch2_i386.deb
python2.5_2.5-5+etch2.diff.gz
to main/p/python2.5/python2.5_2.5-5+etch2.diff.gz
python2.5_2.5-5+etch2.dsc
to main/p/python2.5/python2.5_2.5-5+etch2.dsc
python2.5_2.5-5+etch2_i386.deb
to main/p/python2.5/python2.5_2.5-5+etch2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 560...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Giuseppe Iuculano <iucul...@debian.org> (supplier of updated python2.5 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 24 Jan 2010 14:03:28 +0100
Source: python2.5
Binary: python2.5-dbg idle-python2.5 python2.5 python2.5-examples
python2.5-minimal python2.5-doc python2.5-dev
Architecture: source i386 all
Version: 2.5-5+etch2
Distribution: oldstable-security
Urgency: high
Maintainer: Matthias Klose <d...@debian.org>
Changed-By: Giuseppe Iuculano <iucul...@debian.org>
Description:
idle-python2.5 - An IDE for Python (v2.5) using Tkinter
python2.5 - An interactive high-level object-oriented language (version 2.5)
python2.5-dbg - Debug Build of the Python Interpreter (version 2.5)
python2.5-dev - Header files and a static library for Python (v2.5)
python2.5-examples - Examples for the Python language (v2.5)
python2.5-minimal - A minimal subset of the Python language (version 2.5)
Closes: 493797 560913
Changes:
python2.5 (2.5-5+etch2) oldstable-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Fixed integer overflow in _hashopenssl.c (CVE-2008-2316) (Closes: #493797)
* Fix two denial-of-service vulnerabilities: CVE-2009-3560 and CVE-2009-3720.
(Closes: #560913)
Files:
61c8f540d768731518e649f759ad1500 1313 python optional python2.5_2.5-5+etch2.dsc
2d1944512d0eaa925a4a158b2c3a5845 271887 python optional
python2.5_2.5-5+etch2.diff.gz
8732b224b59cd6488596117d074831f9 645704 python optional
python2.5-examples_2.5-5+etch2_all.deb
9de6fad0cf4c106d77c4189ecf3f0fab 62226 python optional
idle-python2.5_2.5-5+etch2_all.deb
9101b64a6cb48cf6291fc87942b55d4d 3485076 python optional
python2.5_2.5-5+etch2_i386.deb
561f5fe2c20f9f39f49c8d70957e1f45 785708 python optional
python2.5-minimal_2.5-5+etch2_i386.deb
31d78c6b03be55424756c653239d008d 1678912 python optional
python2.5-dev_2.5-5+etch2_i386.deb
8b1713968b57cc2893ed0d06d8e7a846 6008832 python extra
python2.5-dbg_2.5-5+etch2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAktcVlEACgkQNxpp46476aq3JgCgheAR2ZDY/eeJSq/zRdvhO1PE
EUkAoI5NyE8YrRbaglD3CPssFqmG5JbU
=LXCm
-----END PGP SIGNATURE-----
--- End Message ---
