Your message dated Sun, 13 Nov 2011 20:00:45 +0000
with message-id <[email protected]>
and subject line Bug#646517: fixed in python-django-piston 0.2.2-1+squeeze1
has caused the Debian Bug report #646517,
regarding Insecure use of pickle when deserializing POST/PUT input
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
646517: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=646517
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: python-django-piston
Version: 0.2.2-1
Severity: important
Hello,
/usr/share/pyshared/piston/emitters.py:398 contains:
Mimer.register(pickle.loads, ('application/python-pickle',))
If I cross-reference it with
https://bitbucket.org/jespern/django-piston/wiki/Documentation#!receiving-data
where it says: "It should be noted that sending anything that
deserializes to this handler will also work", then I understand that I
can POST or PUT pickled data to piston and it will happily call
pickle.loads on it.
Which is kind of wrong: http://nadiana.com/python-pickle-insecure
(that's the first link I got out of Google, but I reckon you already
know the gist).
As a mitigation, I'll volunteer the best I could get as a safe
unpickler:
import cPickle as pickle
def unpickle(inputfd):
unp = pickle.Unpickler(inputfd)
unp.find_global = None
return unp.load()
Noone's told me yet how to feed malicious pickles to it, but noone has
guaranteed me yet that this is actually safe. One would need to audit
cPickle's code to know, and I haven't done it.
Of course this would reduce functionality, as it will not unpickle
complex objects.
I reckon the best default behaviour would be to disable unpickling, with
options to either have the full unpickling. Safe unpickling would be a
really really nice thing to have in Python in general, but seeing as
nobody guarantees that such a thing exists, I'm not sure it is a good
idea to offer it as an option.
Best regards,
Enrico
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 3.0.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages python-django-piston depends on:
ii python-decorator 3.3.2-1
ii python-django 1.3.1-2
ii python-oauth 1.0.1-3
ii python-support 1.0.14
python-django-piston recommends no packages.
Versions of packages python-django-piston suggests:
ii python-yaml 3.10-1
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: python-django-piston
Source-Version: 0.2.2-1+squeeze1
We believe that the bug you reported is fixed in the latest version of
python-django-piston, which is due to be installed in the Debian FTP archive:
python-django-piston_0.2.2-1+squeeze1.debian.tar.gz
to
main/p/python-django-piston/python-django-piston_0.2.2-1+squeeze1.debian.tar.gz
python-django-piston_0.2.2-1+squeeze1.dsc
to main/p/python-django-piston/python-django-piston_0.2.2-1+squeeze1.dsc
python-django-piston_0.2.2-1+squeeze1_all.deb
to main/p/python-django-piston/python-django-piston_0.2.2-1+squeeze1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Ziegler <[email protected]> (supplier of updated
python-django-piston package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 01 Nov 2011 19:37:58 +0100
Source: python-django-piston
Binary: python-django-piston
Architecture: source all
Version: 0.2.2-1+squeeze1
Distribution: squeeze-security
Urgency: low
Maintainer: Debian Python Modules Team
<[email protected]>
Changed-By: Michael Ziegler <[email protected]>
Description:
python-django-piston - Django mini-framework creating RESTful APIs
Closes: 646517
Changes:
python-django-piston (0.2.2-1+squeeze1) squeeze-security; urgency=low
.
* Fix a security issue in the YAML emitter. (CVE-2011-4103)
* Disable the pickle loader due to security concerns (Closes: #646517)
Checksums-Sha1:
1d2c48a205b7a7491a9c43dee6d3b064d0904ac1 1838
python-django-piston_0.2.2-1+squeeze1.dsc
6764ac8ca9bcb42e9fef903981b274a8c7642356 33750
python-django-piston_0.2.2.orig.tar.bz2
08b54abb4a935994c7c36d74cbb4714d6aca64d1 4621
python-django-piston_0.2.2-1+squeeze1.debian.tar.gz
eb1fef3c562a3bd3fa6acb7f8e86cecf6d480d9d 22182
python-django-piston_0.2.2-1+squeeze1_all.deb
Checksums-Sha256:
3699703a8f4f0f60b030eb6770902a46c92d2e99813c2e4162c4e44470b6d650 1838
python-django-piston_0.2.2-1+squeeze1.dsc
94b1a4f3471e85e106515641a8b8a8ac1ed0d28ea60c6f82f291f2e8a85e75c1 33750
python-django-piston_0.2.2.orig.tar.bz2
c028619bfb13ed2e7ea7a762a2862956da1ba6b4c75554fdb8e7729b3acf8672 4621
python-django-piston_0.2.2-1+squeeze1.debian.tar.gz
29dc7cc4a290f9db67e638a47464e9470f2ba6bdb9d33834e649721df2599b85 22182
python-django-piston_0.2.2-1+squeeze1_all.deb
Files:
1ae54311cb354edba74f5d07f6202679 1838 python optional
python-django-piston_0.2.2-1+squeeze1.dsc
bfa9efaf5a624342e42018f2b2ac3a85 33750 python optional
python-django-piston_0.2.2.orig.tar.bz2
733220f4e78e931b4c7976dee4fdde3d 4621 python optional
python-django-piston_0.2.2-1+squeeze1.debian.tar.gz
49c2f323c1023502806be22ef3df7072 22182 python optional
python-django-piston_0.2.2-1+squeeze1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iQEcBAEBAgAGBQJOvYZRAAoJEL97/wQC1SS+aXYH/R6tzt8KOBnYC/EqjOqQXS3H
lboIFkzONU3NAYcXgddCVUqkj417c4j8u+uNK+xdIztBSgsbHbcXhguiIocG+mGd
V7vVc4XrmbRLdclvKS476IHcCoSfXI2jWwFyjrFynrX6XVHwNMqLhsiv5B5lXEAb
nH2Mwxglj93ofxpPVuiomcckRdM0v1fZ8BgXG0sV+Lg0dd1q7QBzPpAeBLVNxl74
6LCnJ96D1t0xMZaHt2OnmwjJXAaYbN+2QfpXkg9w4BUfgfL84MXgLqga2Q8A6arI
GxmLQnW/IyQZYmdSz6jRSYb82ZsWI910NLiKA448wIe20wFfFQH4TkZpEDtYkwU=
=Gh23
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
Python-modules-team mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/python-modules-team
