oss-sec mailing list archives
Re: Issue with PYTHON_EGG_CACHE
From: cve-assign () mitre org
Date: Sun, 15 Dec 2013 14:47:12 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
OpenStack swift:
os.environ['PYTHON_EGG_CACHE'] = '/tmp'
This message seems to disclose a vulnerability in an unspecified version of OpenStack Swift. It might be the same as this part of the http://tarballs.openstack.org/swift/swift-1.11.0.tar.gz distribution: swift/common/manager.py def setup_env(): ... os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp') http://git.openstack.org/cgit/openstack/swift/tree/swift/common/manager.py http://www.openstack.org/projects/openstack-security/ says "How to Report Security Issues to OpenStack ... Open a bug in Launchpad and mark it as a 'security bug'. This will make the bug Private and only accessible to the Vulnerability Management Team." We don't know whether that has been done. It may be inapplicable because the information isn't private. Use CVE-2013-7109 for this report about OpenStack Swift. Again, CVE-2013-7109 is not an ID for which setuptools is the affected product.
Google search: PYTHON_EGG_CACHE "/tmp" filetype:py
This seems very useful, but it's not a type of information that MITRE is interested in working with at this exact moment. At first glance, the Google search results seem to include all of the following: - cases in which something equivalent to "os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')" is used within code that's intended for distribution as a "product" - cases in which something equivalent to "os.environ.setdefault('PYTHON_EGG_CACHE', '/tmp')" is used within other types of code such as site-specific code or example code - cases in which setting PYTHON_EGG_CACHE would not actually occur (comments, documentation, discussion, etc.) We can assign CVE IDs for the first category, i.e., cases in which someone has identified this as a security problem within a specific software product. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSrgaXAAoJEKllVAevmvmsaf4IAKucJyDDjHoKlexqpH2lk2iZ sArZ3BXydRbvwSsQYiwB6gh/0ncqjszaE4fqcoPLSdG1s9FTHaIwQWAdbVBNYlwM CPuRj4iQbce5D8+PBIgnbF051W/vIDnJAgcE67FfVG0gX1DbOCR/UHkiy6kgrlt8 r92uO2KQ7DtJ68g6xf4N0iHiF5wM4IAbIRAvx4ia7Qj6mdYdXWbLRQnDP4qfeSnJ X0qzn9eVIutWp1VM3+dIarGUOeaRCV8yOvWPz2nt3HGrCMMWEiZhecUUBIUqPLrN orLeQuU1u1qi72kaYldWKbT9/4SZgjKHs2QkuUcghMyY5vaYNwXbN8IbmHdseqk= =e156 -----END PGP SIGNATURE-----
Current thread:
- Issue with PYTHON_EGG_CACHE Grant Murphy (Dec 08)
- Re: Issue with PYTHON_EGG_CACHE cve-assign (Dec 09)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 13)
- Re: Issue with PYTHON_EGG_CACHE cve-assign (Dec 15)
- Re: Re: Issue with PYTHON_EGG_CACHE Jeremy Stanley (Dec 15)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 15)
- Re: Re: Issue with PYTHON_EGG_CACHE Yves-Alexis Perez (Dec 16)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 16)
- Re: Re: Issue with PYTHON_EGG_CACHE Yves-Alexis Perez (Dec 17)
- Re: Re: Issue with PYTHON_EGG_CACHE Kurt Seifried (Dec 13)
- Re: Issue with PYTHON_EGG_CACHE cve-assign (Dec 09)