Bug 1060304 - (CVE-2014-1838, CVE-2014-1839) CVE-2014-1838 CVE-2014-1839 python-logilab-common: multiple temporary file vulnerabilities
CVE-2014-1838 CVE-2014-1839 python-logilab-common: multiple temporary file vu...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 1060306 1060307
Blocks: 1060305
  Show dependency treegraph
Reported: 2014-01-31 13:21 EST by Vincent Danen
Modified: 2015-02-27 17:41 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2014-01-31 13:21:34 EST
Jakub Wilk found and reported in a Debian bug report [1] the following flaws in the logilab-common Python module:

In logilab/common/pdf_ext.py it uses fully predictable names:

def extract_keys_from_pdf(filename):
    # what about using 'pdftk filename dump_data_fields' and parsing the output ?
    os.system('pdftk %s generate_fdf output /tmp/toto.fdf' % filename)
    lines = file('/tmp/toto.fdf').readlines()
    return extract_keys(lines)

def fill_pdf(infile, outfile, fields):
    write_fields(file('/tmp/toto.fdf', 'w'), fields)
    os.system('pdftk %s fill_form /tmp/toto.fdf output %s flatten' % (infile, outfile))

And in logilab/common/shellutils.py:

class Execute:
    """This is a deadlock safe version of popen2 (no stdin), that returns
    an object with errorlevel, out and err.

    def __init__(self, command):
        outfile = tempfile.mktemp()
        errfile = tempfile.mktemp()
        self.status = os.system("( %s ) >%s 2>%s" %
                                (command, outfile, errfile)) >> 8
        self.out = open(outfile, "r").read()
        self.err = open(errfile, "r").read()

tempfile.mktemp() should be replaced with tempfile.mkstemp() as it is documented [2] as insecure.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737051
[2] http://docs.python.org/2/library/tempfile.html
Comment 1 Vincent Danen 2014-01-31 13:25:56 EST
Created python-logilab-common tracking bugs for this issue:

Affects: epel-all [bug 1060306]
Affects: fedora-all [bug 1060307]
Comment 2 Murray McAllister 2014-02-03 02:26:19 EST
The logilab/common/pdf_ext.py issue was assigned CVE-2014-1838

The logilab/common/shellutils.py issue was assigned CVE-2014-1839

Reference: http://seclists.org/oss-sec/2014/q1/226
Comment 3 Fedora Update System 2014-03-19 04:39:38 EDT
pylint-1.1.0-1.fc20, python-astroid-1.0.1-2.fc20, python-logilab-common-0.61.0-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Kurt Seifried 2014-07-16 02:17:57 EDT
Sat6 no longer contains this package, as it won't be included in the Sat6 GA I'm removing it from the whiteboard.
Comment 5 Fedora Update System 2015-02-27 17:41:24 EST
pylint-1.3.1-1.el6, python-logilab-common-0.62.1-2.el6, python-astroid-1.2.1-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.