Re: Untrusted search path vulnerabilities

2010-11-28 Thread Floris Bruynooghe
On 28 November 2010 00:18, Jakub Wilk wrote: > * Floris Bruynooghe , 2010-11-28, 00:06: >> >> So now that these have been filed, is there a consensus on what to do >> if only documentation is affected? > > How about, well, fixing it? :) It's not like correcting documentation is > rocket science.

Re: Untrusted search path vulnerabilities

2010-11-27 Thread Jakub Wilk
* Floris Bruynooghe , 2010-11-28, 00:06: So now that these have been filed, is there a consensus on what to do if only documentation is affected? How about, well, fixing it? :) It's not like correcting documentation is rocket science. In any case I don't think it's RC or warrants an upload

Re: Untrusted search path vulnerabilities

2010-11-27 Thread Floris Bruynooghe
[Sandro: sorry for the mistaken private reply] On 27 November 2010 22:50, Sandro Tosi wrote: > On Mon, Nov 22, 2010 at 14:50, Jakub Wilk wrote: >> * Sandro Tosi , 2010-11-17, 23:37: Any volunteers to file bugs? :) >>> >>> I'll do that tomorrow, if no-one beats me. >> >> Any news on tha

Re: Untrusted search path vulnerabilities

2010-11-27 Thread Sandro Tosi
On Sun, Nov 28, 2010 at 00:13, Jakub Wilk wrote: > * Sandro Tosi , 2010-11-27, 23:50: > > Any volunteers to file bugs? :) I'll do that tomorrow, if no-one beats me. >>> >>> Any news on that? :) >> >> FSVO "tomorrow": done ;) >> >> >> http://bugs.debian.org/cgi-bin/pkgreport.cgi?t

Re: Untrusted search path vulnerabilities

2010-11-27 Thread Jakub Wilk
* Sandro Tosi , 2010-11-27, 23:50: Any volunteers to file bugs? :) I'll do that tomorrow, if no-one beats me. Any news on that? :) FSVO "tomorrow": done ;) http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=pythonpath;users=debian-pyt...@lists.debian.org Thanks a bunch! Though I see somet

Re: Untrusted search path vulnerabilities

2010-11-27 Thread Sandro Tosi
On Mon, Nov 22, 2010 at 14:50, Jakub Wilk wrote: > * Sandro Tosi , 2010-11-17, 23:37: >>> >>> Any volunteers to file bugs? :) >> >> I'll do that tomorrow, if no-one beats me. > > Any news on that? :) FSVO "tomorrow": done ;) http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=pythonpath;users=debia

Re: Untrusted search path vulnerabilities

2010-11-22 Thread Jakub Wilk
* Sandro Tosi , 2010-11-17, 23:37: Any volunteers to file bugs? :) I'll do that tomorrow, if no-one beats me. Any news on that? :) -- Jakub Wilk -- To UNSUBSCRIBE, email to debian-python-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Re: Untrusted search path vulnerabilities

2010-11-22 Thread Jakub Wilk
* Mike Hommey , 2010-11-18, 12:17: A number of packages in the archive sets the PYTHONPATH environment variable in an insecure way. They do something like:      PYTHONPATH=/spam/eggs:$PYTHONPATH This is wrong, because if PYTHONPATH were originally unset or empty, current working directory wou

Re: Untrusted search path vulnerabilities

2010-11-22 Thread Filippo Rusconi
Hello, everybody, On Mon, Nov 22, 2010 at 08:36:59AM +0100, Vincent Bernat wrote: > OoO Vers la fin de l'après-midi du dimanche 21 novembre 2010, vers > 16:37, Filippo Rusconi disait : > > > OK, so I may test if the content of the PYTHONPATH variable is empty > > the way below, so that I c

Re: Untrusted search path vulnerabilities

2010-11-21 Thread Vincent Bernat
OoO Vers la fin de l'après-midi du dimanche 21 novembre 2010, vers 16:37, Filippo Rusconi disait : > OK, so I may test if the content of the PYTHONPATH variable is empty > the way below, so that I can set the path in differenciated manners : > ~~ start-script ~~~ > #!/bin/

Re: Untrusted search path vulnerabilities

2010-11-21 Thread Filippo Rusconi
Hello, Pythonistas, in my slow learning of Python and of Python program packaging, here am I again asking for advice: On Wed, Nov 17, 2010 at 10:58:48PM +0100, Jakub Wilk wrote: > A number of packages in the archive sets the PYTHONPATH environment > variable in an insecure way. They do something

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Chow Loong Jin
On Friday 19,November,2010 03:47 AM, Filippo Rusconi wrote: > Hello, Pythonistas, > > in my slow learning of Python and of Python program packaging, here am > I again asking for advice: > > On Wed, Nov 17, 2010 at 10:58:48PM +0100, Jakub Wilk wrote: >> A number of packages in the archive sets the

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Filippo Rusconi
Hello, Pythonistas, in my slow learning of Python and of Python program packaging, here am I again asking for advice: On Wed, Nov 17, 2010 at 10:58:48PM +0100, Jakub Wilk wrote: > A number of packages in the archive sets the PYTHONPATH environment > variable in an insecure way. They do something

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Mike Hommey
On Thu, Nov 18, 2010 at 07:04:07PM +0800, Paul Wise wrote: > > On Wed, Nov 17, 2010 at 22:58, Jakub Wilk wrote: > >> A number of packages in the archive sets the PYTHONPATH environment > >> variable > >> in an insecure way. They do something like: > >> > >>      PYTHONPATH=/spam/eggs:$PYTHONPATH

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Paul Wise
> On Wed, Nov 17, 2010 at 22:58, Jakub Wilk wrote: >> A number of packages in the archive sets the PYTHONPATH environment variable >> in an insecure way. They do something like: >> >>      PYTHONPATH=/spam/eggs:$PYTHONPATH >> >> This is wrong, because if PYTHONPATH were originally unset or empty,

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Sandro Tosi
Hi all, here below the mail Jakub sent to d-python yesterday, I'm bouncing it now to d-d now to wider spread and as a notification of an upcoming mbf (if no stop comes it's expected to happen this evening). Please follow the whole thread at [1] for further discussion (and keep d-p in the loop in ca

Re: Untrusted search path vulnerabilities

2010-11-18 Thread Sandro Tosi
Hi all, here below the mail Jakub sent to d-python yesterday, I'm bouncing it now to d-d now to wider spread and as a notification of an upcoming mbf (if no stop comes it's expected to happen this evening). Please follow the whole thread at [1] for further discussion (and keep d-p in the loop in ca

Re: Untrusted search path vulnerabilities

2010-11-17 Thread Jakub Wilk
* Sandro Tosi , 2010-11-17, 23:37: Any volunteers to file bugs? :) I'll do that tomorrow, if no-one beats me. Thanks. Severity? grave for the vulnerable packages, important for the others? I think so. in this case, was release team already contacted about that? I don't think this mini-R

Re: Untrusted search path vulnerabilities

2010-11-17 Thread Sandro Tosi
Hi Jakub & all others, nice to see you back at full force :) On Wed, Nov 17, 2010 at 22:58, Jakub Wilk wrote: > Any volunteers to file bugs? :) I'll do that tomorrow, if no-one beats me. Severity? grave for the vulnerable packages, important for the others? in this case, was release team alread

Re: Untrusted search path vulnerabilities

2010-11-17 Thread Éric Araujo
Hello, > * python2.7-examples (2.7-9) > * python3.1-examples (3.1.2+20100926-1, 3.1.2+20101012-1) > * python3.2-examples (3.2~a3-1) For the person reporting those: If they need to be forwarded upstream, feel free to cc: me in the bug report and I’ll do it. Regards -- To UNSUBSCRIBE, email to

Untrusted search path vulnerabilities

2010-11-17 Thread Jakub Wilk
A number of packages in the archive sets the PYTHONPATH environment variable in an insecure way. They do something like: PYTHONPATH=/spam/eggs:$PYTHONPATH This is wrong, because if PYTHONPATH were originally unset or empty, current working directory would be added to sys.path. These pa