Bug 470915 (CVE-2008-5031)

Summary:	CVE-2008-5031 python: stringobject, unicodeobject integer overflows
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ivazqueznet, james.antill, jonathansteffan, kreilly, psplicha
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	531760 (view as bug list)		Environment:
Last Closed:	2013-04-04 02:03:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	486114, 486329, 486330, 486351, 486352, 537915
Bug Blocks:

Description Jan Lieskovsky 2008-11-10 20:49:17 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5031 to
the following vulnerability:

Multiple integer overflows in Python 2.5.2 allow context-dependent
attackers to have an unknown impact via a large integer value in the
tabsize argument to the expandtabs method, as implemented by (1) the
string_expandtabs function in Objects/stringobject.c and (2) the
unicode_expandtabs function in Objects/unicodeobject.c.  NOTE: this
vulnerability reportedly exists because of an incomplete fix for
CVE-2008-2315.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5031
http://www.openwall.com/lists/oss-security/2008/11/05/2
http://www.openwall.com/lists/oss-security/2008/11/05/3
http://scary.beasts.org/security/CESA-2008-008.html
http://svn.python.org/view/python/trunk/Objects/unicodeobject.c?rev=61350&amp;view=diff&amp;r1=61350&amp;r2=61349&amp;p1=python/trunk/Objects/unicodeobject.c&amp;p2=/python/trunk/Objects/unicodeobject.c
http://svn.python.org/view/python/trunk/Objects/stringobject.c?rev=61350&amp;view=diff&amp;r1=61350&amp;r2=61349&amp;p1=python/trunk/Objects/stringobject.c&amp;p2=/python/trunk/Objects/stringobject.c

Patch against trunk:
http://svn.python.org/view?rev=61350&view=rev

Patch against release25-maint:
http://svn.python.org/view?rev=61349&amp;view=rev

Reproducer:
http://scary.beasts.org/security/CESA-2008-008.html
(part "Integer overflow in string expandtabs operation")

Comment 1 Jan Lieskovsky 2008-11-10 20:51:00 UTC

Other reproducers demonstrating this flaw:

* string poc:
s = 'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))

* unicode poc:
s = u'AA\t\n\tAAAAAAAA'
len(s.expandtabs(0x7ffffffe))

Comment 2 Jan Lieskovsky 2008-11-10 20:52:54 UTC

Affected python versions:  2.2.3 <= x <= 2.5.2

This issue affects all versions of the python package, as shipped with
Red Hat Enterprise Linux 3, 4 and 5.

This issue affects all versions of the python package, as shipped with
Fedora releases of 8, 9 and 10.

Comment 8 errata-xmlrpc 2009-07-27 09:23:23 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1176 https://rhn.redhat.com/errata/RHSA-2009-1176.html

Comment 9 errata-xmlrpc 2009-07-27 09:35:47 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1177 https://rhn.redhat.com/errata/RHSA-2009-1177.html

Comment 10 errata-xmlrpc 2009-07-27 09:37:41 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 3

Via RHSA-2009:1178 https://rhn.redhat.com/errata/RHSA-2009-1178.html

Comment 11 Jonathan Steffan 2009-09-07 21:55:54 UTC

To address this issue in the F-10 branch, should I be updating to 2.5.4 which has addressed this CVE?

Comment 13 Vincent Danen 2013-04-04 02:03:26 UTC

Statement:

(none)