oss-sec mailing list archives
Re: Requesting CVE-ID(s) for Python's pip
From: Daniel Kahn Gillmor <dkg () fifthhorseman net>
Date: Thu, 01 Aug 2013 11:42:11 -0400
On 07/30/2013 02:29 AM, Kurt Seifried wrote:
I'm not sure in this case MD5 alone is a security vulnerability, I think previously it had been decided that just because it uses MD5 wasn't ernough to get a CVE, it had to have some specific use that made MD5 a problem. OTOH DES is at this point worthy of a CVE since you can crack it in a reasonable amount of time on AWS/etc for a few hundred bucks or less. Personally I would assign a CVE to everything using MD5 by default to try and help kill it off, but that would be a lot of CVEs.
Maybe it's worth examining what sort of attack vectors are possible when MD5 is relied upon that are not possible if stronger digests are required. MD5 is currently known to be vulnerable to collision attacks, but no one (to my knowledge) has published anything close to an effective pre-image attack yet. I'm assuming that pip is checking the digests of a source tarball fetched from a mirror based on a manifest that is signed by a well-known key (if my understanding of the architecture is wrong, please correct me!) here's one conceivable attack that exploits MD5's failed collision resistance: Consider an attacker who can upload a python module to the pypi repository to get them included in the manifest, and who can tamper with a mirror or can modify traffic on their victim's network. This attacker could craft two versions of their module that have the same MD5 digest, but one of them is innocuous and the other is malicious. The attacker then uploads the innocuous one to the main archive, it is vetted by whatever is the normal pypi policy, and its MD5 sum is included in the standard signed manifest. Then the victim goes to fetch it, the attacker replaces the download with the malicious version. If pip is only checking MD5 digests, it sees that the digest is correct, and the victim has no idea that they received anything different than the innocuous version. The general public never sees the malicious code. This attack requires that the attacker already have a significant set of dangerous powers (uploading to pypi, control of the victim's chosen mirror or network), but it enables them to pull off the attack in secrecy at least. Regards, --dkg
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Requesting CVE-ID(s) for Python's pip isis agora lovecruft (Jul 26)
- Re: Requesting CVE-ID(s) for Python's pip Donald Stufft (Jul 26)
- Re: Requesting CVE-ID(s) for Python's pip Kurt Seifried (Jul 29)
- Re: Requesting CVE-ID(s) for Python's pip Donald Stufft (Jul 29)
- Re: Requesting CVE-ID(s) for Python's pip isis agora lovecruft (Aug 01)
- Re: Requesting CVE-ID(s) for Python's pip Jeremy Stanley (Aug 01)
- Re: Requesting CVE-ID(s) for Python's pip Kurt Seifried (Jul 29)
- Re: Requesting CVE-ID(s) for Python's pip Daniel Kahn Gillmor (Aug 01)
- Re: Requesting CVE-ID(s) for Python's pip Donald Stufft (Jul 26)