python-cherrypy: CVE-2008-0252 directory traversal vulnerability

Debian Bug report logs - #461069
python-cherrypy: CVE-2008-0252 directory traversal vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: submit@bugs.debian.org

Subject: python-cherrypy: CVE-2008-0252 directory traversal vulnerability

Date: Wed, 16 Jan 2008 13:53:09 +0100

[Message part 1 (text/plain, inline)]

Package: python-cherrypy
Version: 2.2.1-3
Severity: grave
Tags: security patch

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for python-cherrypy.

CVE-2008-0252[0]:
| Directory traversal vulnerability in the _get_file_path function in
| (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2)
| filter/sessionfilter.py in CherryPy 2.1, and (3)
| filter/sessionfilter.py in CherryPy 2.x allows remote attackers to
| create or delete arbitrary files, and possibly read and write portions
| of arbitrary files, via a crafted session id in a cookie.

You can find a patch for this on:
http://www.cherrypy.org/changeset/1775

If you fix this vulnerability please also include the CVE id
in your changelog entry.

For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0252

Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #10 received at 461069@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 461069@bugs.debian.org

Subject: intend to NMU

Date: Fri, 18 Jan 2008 16:39:45 +0100

[Message part 1 (text/plain, inline)]

Hi Gustavo,
As discussed on jabber, here is the debdiff (also attached 
to this mail)
http://people.debian.org/~nion/nmu-diff/python-cherrypy-2.2.1-3_2.2.1-3.1.patch

I am going to upload this today.

Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[python-cherrypy-2.2.1-3_2.2.1-3.1.patch (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #15 received at 461069-close@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 461069-close@bugs.debian.org

Subject: Bug#461069: fixed in python-cherrypy 2.2.1-3.1

Date: Fri, 18 Jan 2008 15:47:04 +0000

Source: python-cherrypy
Source-Version: 2.2.1-3.1

We believe that the bug you reported is fixed in the latest version of
python-cherrypy, which is due to be installed in the Debian FTP archive:

python-cherrypy_2.2.1-3.1.diff.gz
  to pool/main/p/python-cherrypy/python-cherrypy_2.2.1-3.1.diff.gz
python-cherrypy_2.2.1-3.1.dsc
  to pool/main/p/python-cherrypy/python-cherrypy_2.2.1-3.1.dsc
python-cherrypy_2.2.1-3.1_all.deb
  to pool/main/p/python-cherrypy/python-cherrypy_2.2.1-3.1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 461069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nico Golde <nion@debian.org> (supplier of updated python-cherrypy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 18 Jan 2008 16:25:39 +0100
Source: python-cherrypy
Binary: python-cherrypy
Architecture: source all
Version: 2.2.1-3.1
Distribution: unstable
Urgency: high
Maintainer: Gustavo Noronha Silva <kov@debian.org>
Changed-By: Nico Golde <nion@debian.org>
Description: 
 python-cherrypy - Python web development framework
Closes: 461069
Changes: 
 python-cherrypy (2.2.1-3.1) unstable; urgency=high
 .
   * Non-maintainer upload by security team.
   * This update addresses the following security issue:
     - Directory traversal vulnerability in the _get_file_path function
       in filter/sessionfilter.py allows remote attackers to create or
       delete arbitrary files, and possibly read and write portions of
       arbitrary files, via a crafted session id in a cookie
       (CVE-2008-0252; Closes: #461069).
Files: 
 73ffb1d64656c5c1141e236fa5811cae 818 python optional python-cherrypy_2.2.1-3.1.dsc
 89d9de9656065c79ac7e1fb7c6cb073f 5530 python optional python-cherrypy_2.2.1-3.1.diff.gz
 f753b6034a0c9cb4ca339ca93ae54f74 220648 python optional python-cherrypy_2.2.1-3.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHkMkNHYflSXNkfP8RAlMrAKCMzgMavjxugfwhTUi3grcfsfiZ5wCfa7QB
sxcThqrWqUXIFx5rJThakvE=
=psKV
-----END PGP SIGNATURE-----

Message #20 received at 461069-close@bugs.debian.org (full text, mbox, reply):

From: Gustavo Noronha Silva <kov@debian.org>

To: 461069-close@bugs.debian.org

Subject: Bug#461069: fixed in python-cherrypy 2.2.1-4

Date: Thu, 24 Jan 2008 16:17:05 +0000

Source: python-cherrypy
Source-Version: 2.2.1-4

We believe that the bug you reported is fixed in the latest version of
python-cherrypy, which is due to be installed in the Debian FTP archive:

python-cherrypy_2.2.1-4.diff.gz
  to pool/main/p/python-cherrypy/python-cherrypy_2.2.1-4.diff.gz
python-cherrypy_2.2.1-4.dsc
  to pool/main/p/python-cherrypy/python-cherrypy_2.2.1-4.dsc
python-cherrypy_2.2.1-4_all.deb
  to pool/main/p/python-cherrypy/python-cherrypy_2.2.1-4_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 461069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Gustavo Noronha Silva <kov@debian.org> (supplier of updated python-cherrypy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 24 Jan 2008 13:31:32 -0200
Source: python-cherrypy
Binary: python-cherrypy
Architecture: source all
Version: 2.2.1-4
Distribution: unstable
Urgency: low
Maintainer: Gustavo Noronha Silva <kov@debian.org>
Changed-By: Gustavo Noronha Silva <kov@debian.org>
Description: 
 python-cherrypy - Python web development framework
Closes: 461069
Changes: 
 python-cherrypy (2.2.1-4) unstable; urgency=low
 .
   [ Piotr Ożarowski ]
   * Vcs-Svn, Vcs-Browser and Homepage fields added
   * New python-support handles egg's directory name correctly
     - bump python-support required version
     - remove mv part from debian/rules
 .
   [ Loic Minier ]
   * Only track 2.x versions in watch file; thanks Goedson Teixeira Paixao.
 .
   [ Scott Kitterman ]
   * debian/patches/03_autoreloader_fix.dpatch
     - Fixed the auto-reloader if modules with an invalid __file__ attribute
       are loaded, using code from CherryPy 3.
 .
   [ Sandro Tosi ]
   * debian/control
     - uniforming Vcs-Browser field
 .
   [ Gustavo Noronha Silva ]
   * acknowledging NMU by Nico, thanks! (Closes: #461069)
   * debian/control:
   - updated Standards-Version to 3.7.3
   - turn build-depends-indep into build-deps, since they are needed on clean
Files: 
 b44ac0a4a864b238c348a0532241f9ee 1000 python optional python-cherrypy_2.2.1-4.dsc
 90fa880836403e23324c9da35f9398aa 6327 python optional python-cherrypy_2.2.1-4.diff.gz
 d67a5ab6a4eb6aceed907cb71f99c735 220726 python optional python-cherrypy_2.2.1-4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHmLevt1anjIgqbEsRAkwNAJ45uTFvg62R0T5fh+s7ms97snNTbACghhKD
meEOkULL+Ie8J0uHfBchCf0=
=7rSW
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.