Bug 923974 (CVE-2013-1888)

Summary: CVE-2013-1888 python-pip: insecure temporary directory usage
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: metherid, tflink
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20121115,reported=20130321,source=oss-security,cvss2=2.1/AV:L/AC:L/Au:N/C:N/I:P/A:N,fedora-all/python-pip=affected,epel-all/python-pip=affected
Fixed In Version: python-pip 1.3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-05-02 11:00:58 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 923976, 923975    
Bug Blocks:    

Description Vincent Danen 2013-03-20 16:18:45 EDT
It was reported [1],[2] that the python pip module uses an insecure temporary directory when building (/tmp/pip-build).

This is fixed in upstream git (patches noted from the bug report)

[1] https://github.com/pypa/pip/issues/725
[2] http://seclists.org/oss-sec/2013/q1/704
Comment 1 Vincent Danen 2013-03-20 16:19:49 EDT
Created python-pip tracking bugs for this issue

Affects: fedora-all [bug 923975]
Affects: epel-all [bug 923976]
Comment 2 Vincent Danen 2013-03-25 16:40:15 EDT
This was assigned CVE-2013-1888:

http://www.openwall.com/lists/oss-security/2013/03/22/10
Comment 3 Vincent Danen 2013-05-02 11:00:58 EDT
python-pip version 1.3.1 is now available in Fedora 17, 18, and 19.
Comment 4 Fedora Update System 2013-05-23 08:24:39 EDT
python-virtualenv-1.9.1-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-05-23 08:42:10 EDT
python-virtualenv-1.9.1-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2013-05-24 16:38:34 EDT
python-virtualenv-1.9.1-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2013-05-29 13:34:03 EDT
python-virtualenv-1.9.1-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2013-05-29 13:34:50 EDT
python-virtualenv-1.9.1-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.