Impact Via a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed.
We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython. (It has been fixed for some Python versions.)
Patches Patched in version 8.0 by removing support for try/except clauses
Workarounds There is no workaround.
References none
Description of problem:
A security flaw was discovered in the Python generic FAQ wizard moving tool (move-faqwiz.sh).
Relevant part of the code:
28 cutnpad $1 2 suffix1 29 cutnpad $2 1 prefix2 30 cutnpad $2 2 suffix2 31 tmpfile=tmp$RANDOM.tmp 32 file1=faq$prefix1.$suffix1.htp 33 file2=faq$prefix2.$suffix2.htp
Description:
An attacker could in advance create a symbolic link pointing to tmpXXXXX.tmp (the output produced by $RANDOM is only 5 digits long), then run the Python generic FAQ wizard moving tool which would allow him to erase / truncate the target of the symbolic link to zero size.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attributefilter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.
tarfile hardlink fallback ignores custom extraction filter rejection via None
There is a HIGH severity vulnerability affecting the CPython "zipfile" module.
When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
A vulnerability was found in PyLongFromString() in Python, which is used by int("text"). For non-binary bases it uses an algorithm with quadratic time complexity to convert a string into an arbitrary precision number. It takes about 50ms to parse an int string with 100,000 digits and about 5sec for 1,000,000 digits. The float type, decimal type, int.frombytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected.
Untrusted search path vulnerability in the Python module of xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.
References (test case, PoC): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch: The Debian patch for similar dia's Python related issue, available at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
should be sufficient to resolve this issue.
Untrusted search path vulnerability in dia's Python plug-in alows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251
Test case and more discussion about this issue (and reason's why it can't be fixed in Python is available at): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
End of life: 9/30/2020, Latest version: 3.5.10
End of life: 9/30/2020, Latest version: 3.5.10
End of life: 10/7/2024, End of support: 5/3/2021, Latest version: 3.8.20
End of life: 10/7/2024, End of support: 5/3/2021, Latest version: 3.8.20
End of life: 4/9/2012, Latest version: 3.1.5
End of life: 4/9/2012, Latest version: 3.1.5
End of life: 12/23/2021, End of support: 12/24/2018, Latest version: 3.6.15
End of life: 12/23/2021, End of support: 12/24/2018, Latest version: 3.6.15
End of life: 6/27/2023, End of support: 6/27/2020, Latest version: 3.7.17
End of life: 6/27/2023, End of support: 6/27/2020, Latest version: 3.7.17
End of life: 1/1/2020, Latest version: 2.7.18
End of life: 1/1/2020, Latest version: 2.7.18
End of life: 6/27/2009, Latest version: 3.0.1
End of life: 6/27/2009, Latest version: 3.0.1
End of life: 2/20/2016, Latest version: 3.2.6
End of life: 2/20/2016, Latest version: 3.2.6
End of life: 10/29/2013, Latest version: 2.6.9