Your message dated Sun, 13 Dec 2009 21:59:28 +0000
with message-id <e1njwtq-0004ac...@ries.debian.org>
and subject line Bug#560755: fixed in python-docutils 0.6-2
has caused the Debian Bug report #560755,
regarding python-docutils: insecure use of temporary files
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
560755: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560755
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: python-docutils
Version: 0.5-2
Severity: grave
Tags: security help
Justification: user security hole
Emacs major mode for reStructuredText (rst.el) uses temporary files
with predictable names in an insecure fashion:
| (defun rst-compile-pdf-preview ()
| "Convert the document to a PDF file and launch a preview program."
| (interactive)
| (let* ((tmp-filename "/tmp/out.pdf")
| (command (format "%s %s %s && %s %s"
| (cadr (assq 'pdf rst-compile-toolsets))
| buffer-file-name tmp-filename
| rst-pdf-program tmp-filename)))
| (start-process-shell-command "rst-pdf-preview" nil command)
| ;; Note: you could also use (compile command) to view the compilation
| ;; output.
| ))
[...]
| (defun rst-compile-slides-preview ()
| "Convert the document to an S5 slide presentation and launch a preview
program."
| (interactive)
| (let* ((tmp-filename "/tmp/slides.html")
| (command (format "%s %s %s && %s %s"
| (cadr (assq 's5 rst-compile-toolsets))
| buffer-file-name tmp-filename
| rst-slides-program tmp-filename)))
| (start-process-shell-command "rst-slides-preview" nil command)
| ;; Note: you could also use (compile command) to view the compilation
| ;; output.
| ))
How to reproduce/exploit this bug
---------------------------------
Attacker:
$ ln -sf /path/to/file/the/attacker/want/to/overwrite /tmp/slides.html
Victim:
$ emacs foo.rst
M-x rst-mode
C-c 5
--
Jakub Wilk
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: python-docutils
Source-Version: 0.6-2
We believe that the bug you reported is fixed in the latest version of
python-docutils, which is due to be installed in the Debian FTP archive:
python-docutils_0.6-2.debian.tar.gz
to main/p/python-docutils/python-docutils_0.6-2.debian.tar.gz
python-docutils_0.6-2.dsc
to main/p/python-docutils/python-docutils_0.6-2.dsc
python-docutils_0.6-2_all.deb
to main/p/python-docutils/python-docutils_0.6-2_all.deb
python-roman_0.6-2_all.deb
to main/p/python-docutils/python-roman_0.6-2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 560...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jakub Wilk <uba...@users.sf.net> (supplier of updated python-docutils package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 13 Dec 2009 19:54:12 +0100
Source: python-docutils
Binary: python-docutils python-roman
Architecture: source all
Version: 0.6-2
Distribution: unstable
Urgency: high
Maintainer: Debian Python Modules Team
<python-modules-team@lists.alioth.debian.org>
Changed-By: Jakub Wilk <uba...@users.sf.net>
Description:
python-docutils - utilities for the documentation of Python modules
python-roman - module for generating/analyzing Roman numerals
Closes: 560328 560330 560755
Changes:
python-docutils (0.6-2) unstable; urgency=high
.
* Unconditionally recommend python-lxml, as it is used by
/usr/bin/rst2odt_prepstyles (closes: #560330).
* Demote dependency on an ElementTree implementation to recommendation, as it
is only used by /usr/bin/rst2odt; remove python-lxml from alternatives, as
it is never used by the script (closes: #560328).
* Fix insecure use of temporary files in the Emacs major mode for
reStructuredText (closes: #560755). Thanks to Kumar Appaiah for helping to
deal with this bug.
* Register docutils documentation using doc-base.
Checksums-Sha1:
32db631d6f118150096aeddac5d43389cf1d4915 1680 python-docutils_0.6-2.dsc
5cf1a18fd2948b4122665fc77a4764fc24f55d3c 24302
python-docutils_0.6-2.debian.tar.gz
124590874178ba49ddfec1e417f3d0ada0e30b32 1729834 python-docutils_0.6-2_all.deb
73bc1726ced7b29e409f5687b6d3a3dff4a5488d 14504 python-roman_0.6-2_all.deb
Checksums-Sha256:
a27695a798e9928e33058a42c90251624b9cabe32b4cb456cf3677ea8de649ac 1680
python-docutils_0.6-2.dsc
b346a8f8e91fbaa57152ea98192ad0cece7948b72c09997970ec1eae1594258a 24302
python-docutils_0.6-2.debian.tar.gz
5f0dfb358f2176dfd46154e3777d0f0f0ef21f45f5e0a990bc0038277662944f 1729834
python-docutils_0.6-2_all.deb
93df1be52565b3e033b8ca9e87ed9ff12b1443146669fefc8a639e4dc9841de2 14504
python-roman_0.6-2_all.deb
Files:
3005d4d1f8d25657f9d3a29852df0c41 1680 python optional python-docutils_0.6-2.dsc
ed7caeee69af3c66b89318f9732005c4 24302 python optional
python-docutils_0.6-2.debian.tar.gz
db05761fa3a1e5391fe7334a7b67ae0f 1729834 python optional
python-docutils_0.6-2_all.deb
5d1fcbe673a5edf339236bb49749981a 14504 python optional
python-roman_0.6-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkslXxYACgkQB01zfu119Zn/eACfYkBMmvxWqgwez6/LIOuRB/wl
pjoAn1bkncgsKfjCY51OfPsdIWr5YL1U
=VbEW
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
Python-modules-team mailing list
Python-modules-team@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/python-modules-team
