Bug 47873

Summary:	python2.7: Multiple issues (4.2)
Product:	UCS	Reporter:	Quality Assurance <qa>
Component:	Security updates	Assignee:	Quality Assurance <qa>
Status:	CLOSED FIXED	QA Contact:	Philipp Hahn <hahn>
Severity:	normal
Priority:	P3
Version:	UCS 4.2
Target Milestone:	UCS 4.2-5-errata
Hardware:	All
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Description Quality Assurance

2018-09-27 12:46:30 CEST

New Debian python2.7 2.7.9-2+deb8u2 fixes:
This update addresses the following issues:
* Integer overflow in PyString_DecodeEscape results in heap-base buffer  overflow (CVE-2017-1000158)
* DOS via regular expression catastrophic backtracking in apop() method in  pop3lib (CVE-2018-1060)
* DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in  difflib (CVE-2018-1061)
* Command injection in the shutil module (CVE-2018-1000802)

Comment 1 Quality Assurance

2018-09-27 13:00:35 CEST

--- mirror/ftp/4.2/unmaintained/4.2-0/source/python2.7_2.7.9-2+deb8u1.dsc
+++ apt/ucs_4.2-0-errata4.2-5/source/python2.7_2.7.9-2+deb8u2.dsc
@@ -1,3 +1,12 @@
+2.7.9-2+deb8u2 [Mon, 24 Sep 2018 13:01:22 -0400] Antoine Beaupré <anarcat@debian.org>:
+
+  * Non-maintainer upload by the LTS Security Team.
+  * CVE-2018-1000802: fix command injection in shutil module
+  * CVE-2017-1000158: fix integer overflow and possible arbitrary code
+    execution in the PyString_DecodeEscape function
+  * CVE-2018-1060 and CVE-2018-1061: fix REDOS vulnerabilities in poplib
+    and difflib modules
+
 2.7.9-2+deb8u1 [Wed, 29 Jun 2016 00:02:23 +0200] Moritz Mühlenhoff <jmm@debian.org>:
 
   * Backport upstream commit b3ce713fb9beebfff9848cefa0acbd59acc68fe9

<http://10.200.17.11/4.2-5/#8436704806906245995>

Comment 2 Philipp Hahn

2018-09-27 13:38:51 CEST

OK: yaml
OK: announce_errata
OK: patch
FAIL: piuparts

[4.2-5] f219c79804 Bug #47873: python2.7 2.7.9-2+deb8u2
 doc/errata/staging/python2.7.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

Comment 3 Arvid Requate

2018-10-04 16:16:57 CEST

<http://errata.software-univention.de/ucs/4.2/525.html>