Nikolaus Schulz wrote:
> > Not being a python programmer, I missed the tempfile.tempdir setting,
> > which, if it makes tempfile.mktemp use that temp dir, should make the
> > program safe for all calls to mktemp from then on. Whether it's
> > exploitable would thus depend on whether there are any c
Joey Hess wrote:
> Noah Meyerhans wrote:
> > Upon investigating this for stable, I wonder if the problem is as bad as
> > reported. It seems that archivemail sets up its own temp directory and
> > creates its files in it:
> >
> > # create a temporary directory for us to work in securely
> >
Noah Meyerhans wrote:
> On Wed, Aug 30, 2006 at 12:10:29AM -0400, Joey Hess wrote:
> > Package: archivemail
> > Version: 0.6.2-1
> > Severity: grave
> > Tags: security
>
> This is CVE-2006-4245. Please mention that in a future changelog entry
> for unstable. (I see that you already uploaded 0.6.
Noah Meyerhans wrote:
> Upon investigating this for stable, I wonder if the problem is as bad as
> reported. It seems that archivemail sets up its own temp directory and
> creates its files in it:
>
> # create a temporary directory for us to work in securely
> old_temp_dir = tempfile.temp
Upon investigating this for stable, I wonder if the problem is as bad as
reported. It seems that archivemail sets up its own temp directory and
creates its files in it:
# create a temporary directory for us to work in securely
old_temp_dir = tempfile.tempdir
tempfile.tempdir = None
On Wed, Aug 30, 2006 at 12:10:29AM -0400, Joey Hess wrote:
> Package: archivemail
> Version: 0.6.2-1
> Severity: grave
> Tags: security
This is CVE-2006-4245. Please mention that in a future changelog entry
for unstable. (I see that you already uploaded 0.6.2-2 to fix this in
unstable.)
noah
Package: archivemail
Version: 0.6.2-1
Severity: grave
Tags: security
tempfile.mktemp in python has this comment:
User-callable function to return a unique temporary file name. The
file is not created.
Arguments are as for mkstemp, except that the 'text' argument is
not accepted.
7 matches
Mail list logo
