Bug 846757

Summary:	Current version of python-djblets in Fedora-16 contains embeded copy of python-feedparser, vulnerable to CVE-2009-5065, CVE-2011-1156, CVE-2011-1157, and CVE-2011-1158
Product:	[Fedora] Fedora	Reporter:	Jan Lieskovsky <jlieskov>
Component:	python-djblets	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	16	CC:	dmalcolm, sgallagh
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
URL:	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684250
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	846759 846760 846762 (view as bug list)		Environment:
Last Closed:	2012-08-18 01:26:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	846759, 846760, 846762

Description Jan Lieskovsky 2012-08-08 15:35:26 UTC

Description of problem:
Current version of python-djblets for Fedora-16 contains embedded / own copy of python-feedparser (BUILD/Djblets-0.6.22/djblets/feedview/feedparser.py) code, which is vulnerable to numerous security flaws (CVE-2009-5065, CVE-2011-1156, CVE-2011-1157, and CVE-2011-1158 to mention some of them).

Version-Release number of selected component (if applicable):
python-djblets-0.6.22-1.fc16

Additional info:
See https://bugzilla.redhat.com/show_bug.cgi?id=684877#c2 and https://bugzilla.redhat.com/show_bug.cgi?id=684877#c3 for further details.

Particular python-feedparser issues are as follows:
1, CVE-2009-5065
   Upstream ticket: http://code.google.com/p/feedparser/issues/detail?id=195
   Relevant patch: http://code.google.com/p/feedparser/source/detail?r=336#

2) CVE-2011-1156:
   Upstream ticket: https://code.google.com/p/feedparser/issues/detail?id=91
   Relevant patch: https://code.google.com/p/feedparser/source/detail?r=376#

3) CVE-2011-1157:
   Upstream ticket: https://code.google.com/p/feedparser/issues/detail?id=254
   Relevant patch: https://code.google.com/p/feedparser/source/detail?r=375#

4) CVE-2011-1158:
   Upstream ticket: https://code.google.com/p/feedparser/issues/detail?id=255
   Relevant patch: https://code.google.com/p/feedparser/source/detail?r=374#

Since there is a system version of python-feedparser package available in Fedora-16 (python-feedparser-5.1.2-1.fc16), which is not vulnerable to these issues any more (bug #684877), if possible, python-djblets should be instructed to use system version of the python-feedparser package instead of the embedded feedparser.py code (since if another security issue is found in the embedded code, python-djblets would need to be updated too).

Comment 1 Stephen Gallagher 2012-08-08 16:00:15 UTC

Thanks, I was unaware of this bundling. I'll strip it out immediately (and also notify upstream of this issue).

Comment 2 Fedora Update System 2012-08-08 19:35:58 UTC

python-djblets-0.6.22-2.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/python-djblets-0.6.22-2.fc16

Comment 3 Fedora Update System 2012-08-09 22:58:46 UTC

Package python-djblets-0.6.22-2.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing python-djblets-0.6.22-2.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-11576/python-djblets-0.6.22-2.fc16
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2012-08-18 01:26:20 UTC

python-djblets-0.6.22-2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.