Red Hat Bugzilla – Bug 1146026
CVE-2014-7185 python: buffer() integer overflow leading to out of bounds read
Last modified: 2018-02-14 23:28:29 EST
It was reported [1] that Python 2.7.8 fixes a potential wraparound in buffer() with possible CWE-200 implications. While the CVE request is forPython 2.7, reporter also indicated that earlier versions (1.6.1 through 2.6.9) were also affected. PoC: --- overflow.py --- import sys a = bytearray('here be dragons') b = buffer(a, sys.maxsize, sys.maxsize) print b[:8192] ------------------- Upstream fix is in [2]. [1]: http://seclists.org/oss-sec/2014/q3/638 [2]: https://hg.python.org/cpython/diff/8d963c7db507/Objects/bufferobject.c
Created python tracking bugs for this issue: Affects: fedora-all [bug 1146027]
Created python26 tracking bugs for this issue: Affects: epel-5 [bug 1146028]
MITRE assigned CVE-2014-7185 to this issue: http://openwall.com/lists/oss-security/2014/09/25/47
python-2.7.5-14.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug report: http://bugs.python.org/issue21831
Statement: This issue affects the versions of python as shipped with Red Hat Enterprise Linux 7. A future update may address this issue. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Full upstream commit: https://hg.python.org/cpython/rev/8d963c7db507 Related commit adding the CVE id to the NEWS file: https://hg.python.org/cpython/rev/5ef28c22dc24
This problem is in the buffer() implementation. When creating new buffer object, offset and size arguments were not checked properly to ensure they are within bounds of the existing object. An integer overflow in the check could cause python to allow out of bounds read, which could lead to information disclosure or application crash. https://docs.python.org/2/library/functions.html?highlight=buffer#buffer This bug is only an issue if offset and size arguments are untrusted. The buffer() was removed from Python 3 and hence Python 3 was not affected by this issue.
python-2.7.5-14.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Via RHSA-2015:1064 https://rhn.redhat.com/errata/RHSA-2015-1064.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2015:1330 https://rhn.redhat.com/errata/RHSA-2015-1330.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2101 https://rhn.redhat.com/errata/RHSA-2015-2101.html