Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2012-05-02 Thread Adam D. Barratt
On Tue, 2011-12-20 at 20:18 +, Adam D. Barratt wrote: > On Tue, 2011-12-20 at 09:44 +0100, Piotr Ożarowski wrote: > > [Adam D. Barratt, 2011-12-19] [...] > > > Looking at the diff, and the equivalent code in the unstable package, > > > there seems to be a missing component - namely, that the di

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2012-01-12 Thread Adam D. Barratt
On Tue, 2011-12-20 at 20:18 +, Adam D. Barratt wrote: > On Tue, 2011-12-20 at 09:44 +0100, Piotr Ożarowski wrote: > > [Adam D. Barratt, 2011-12-19] > > > Looking at the diff, and the equivalent code in the unstable package, > > > there seems to be a missing component - namely, that the director

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Adam D. Barratt
On Tue, 2011-12-20 at 21:24 +0100, Nico Golde wrote: > Hi, > * Adam D. Barratt [2011-12-20 21:22]: > > If the thread involved the security team saying "please fix this via > > proposed-updates", there's an implied "by talking to the release team" > > attached. We're generally not involved in such

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Nico Golde
Hi, * Adam D. Barratt [2011-12-20 21:22]: > On Tue, 2011-12-20 at 09:44 +0100, Piotr O??arowski wrote: [...] > > > that's an admirable turn-around :-) it really should have been discussed > > > with the SRMs first, rather than simply uploading (I believe this is > > > well documented enough by no

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Adam D. Barratt
On Tue, 2011-12-20 at 09:44 +0100, Piotr Ożarowski wrote: > [Adam D. Barratt, 2011-12-19] > > I noticed that an upload which appears to fix this issue (although > > without reference the bug number) has appeared in p-u-NEW. Whilst > > sorry, I didn't notice a bug was reported No worries. I assu

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Piotr Ożarowski
[Adam D. Barratt, 2011-12-19] > I noticed that an upload which appears to fix this issue (although > without reference the bug number) has appeared in p-u-NEW. Whilst sorry, I didn't notice a bug was reported > that's an admirable turn-around :-) it really should have been discussed > with the S

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-19 Thread Adam D. Barratt
Hi, On Mon, 2011-12-19 at 17:19 +0100, Nico Golde wrote: > it was discovered that python-virtualenv is handling /tmp files in an > insecure manner. > The following patch fixed this problem: > https://bitbucket.org/ianb/virtualenv/changeset/8be37c509fe5 I noticed that an upload which appears to f