oss-sec mailing list archives
Re: CVE request - Python string expandtabs
From: "Will Drewry" <redpig () ocert org>
Date: Mon, 10 Nov 2008 09:17:51 -0600
On Mon, Nov 10, 2008 at 3:54 AM, Jan Lieskovsky <jlieskov () redhat com> wrote:
Hello Steve, could you allocate a new CVE id for the following Python issue: * Advisory: http://scary.beasts.org/security/CESA-2008-008.html * Issue: Integer overflow in string expandtabs operation * PoC: s = 't\tt\t' str.expandtabs(s, 2147483647) Different issue than CVE-2008-2315 (CVE-2008-2315 mentions patch: http://bugs.gentoo.org/attachment.cgi?id=159418&action=view which is not sufficient to resolve this str_expandtabs issue). * Confirmation from Chris Evans: Adding in Will.... ... yes, this sounds accurate. Searching through my mail, my colleague Will found that the original expandtabs() fix was insufficient (thanks for the catch Will!). * Upstream patch: http://svn.python.org/view?rev=61350&view=rev
This appears to be the patch for 2.6. The 2.5 maintenance patch was one revision earlier: http://svn.python.org/view?rev=61349&view=rev
* Affected Python versions: 2.2.3 <= x <= 2.5.1
Given that there is a patch for 2.6 as well, it might be worth expanding the impacted versions to include it. (I believe 2.5.2 was also affected where r61349 fixed it for 2.5.3.) For patch validation purposes, * string poc: s = 'AA\t\n\tAAAAAAAA' len(s.expandtabs(0x7ffffffe)) * unicode poc: s = u'AA\t\n\tAAAAAAAA' len(s.expandtabs(0x7ffffffe)) cheers, will
Current thread:
- CVE Request - Python string expandtabs Jan Lieskovsky (Nov 05)
- Re: CVE Request - Python string expandtabs Chris Evans (Nov 05)
- Re: CVE Request - Python string expandtabs Steven M. Christey (Nov 10)
- <Possible follow-ups>
- Re: CVE request - Python string expandtabs Will Drewry (Nov 10)
- Re: CVE Request - Python string expandtabs Chris Evans (Nov 05)