Bug 1235688 (CVE-2015-4706, CVE-2015-4707)

Summary:	CVE-2015-4706 CVE-2015-4707 ipython: IPython 3.2 contains important security fixes
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dcantrell, michel, mrunge, orion, python-sig, shahms, tomspur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	IPython 3.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-07-27 18:31:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1235690, 1235691
Bug Blocks:

Description Vasyl Kaigorodov 2015-06-25 13:48:44 UTC

From http://ipython.org/ipython-doc/3/whatsnew/version3.html :

IPython 3.2 contains important security fixes. Users are strongly encouraged to upgrade immediately.

Highlights:

    A security improvement that set the secure attribute to login cookie to prevent them to be sent over http
    Revert the face color of matplotlib axes in the inline backend to not be transparent.
    Enable mathjax safe mode by default
    Fix XSS vulnerability in JSON error messages
    Various widget-related fixes

See Issues closed in the 3.x development cycle for details:
https://github.com/ipython/ipython/issues?utf8=%E2%9C%93&q=milestone%3A3.2+is%3Aclosed+

Comment 1 Vasyl Kaigorodov 2015-06-25 13:49:08 UTC

Created ipython tracking bugs for this issue:

Affects: fedora-all [bug 1235690]
Affects: epel-all [bug 1235691]

Comment 2 Fedora Update System 2015-07-31 18:33:05 UTC

ipython-3.2.1-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.