Bug 854011 (CVE-2012-5659) - CVE-2012-5659 abrt: Arbitrary Python code execution due improper sanitization of the PYTHONPATH environment variable by installing debuginfo packages into cache
Summary: CVE-2012-5659 abrt: Arbitrary Python code execution due improper sanitization...
Alias: CVE-2012-5659
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: Martin Kyral
Depends On: 895442 895443 906280
Blocks: 887869
TreeView+ depends on / blocked
Reported: 2012-09-03 14:45 UTC by Jan Lieskovsky
Modified: 2021-10-19 21:56 UTC (History)
4 users (show)

Fixed In Version: abrt 2.0.13
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2021-10-19 21:56:51 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0215 0 normal SHIPPED_LIVE Important: abrt and libreport security update 2013-02-01 02:37:31 UTC

Description Jan Lieskovsky 2012-09-03 14:45:58 UTC
An insufficient environment sanitization flaw was found in the way 'abrt-action-install-debuginfo-to-abrt-cache' tool, performing installation of required debuginfo packages into ABRT's cache, of ABRT, an automatic bug detection and reporting tool, used the PYTHONPATH environment variable. A local attacker could provide a commonly used Python module with specially-crafted content in non-standard system location / path, which would lead into arbitrary Python code execution with privileges of the 'abrt' user, when the 'abrt-action-install-debuginfo-to-abrt-cache' tool was run from the parent directory of the folder, containing the malicious module.

Issue found by: Miloslav Trmač of Red Hat

Comment 2 Jan Lieskovsky 2012-09-03 14:51:36 UTC
This issue affects the version of the abrt package, as shipped with Red Hat Enterprise Linux 6.


This issue affects the versions of the abrt package, as shipped with Fedora release of 16 and 17.

Comment 5 Huzaifa S. Sidhpurwala 2012-12-20 10:00:00 UTC
Upstream patch:


Comment 7 Jan Lieskovsky 2013-01-24 15:24:57 UTC
The preliminary embargo date for this issue has been set up to next Wednesday, 30-th January of 2013.

Comment 8 Murray McAllister 2013-01-30 06:15:57 UTC

This issue was discovered by Miloslav Trmač of Red Hat.

Comment 9 Huzaifa S. Sidhpurwala 2013-01-31 11:01:46 UTC
Created abrt tracking bugs for this issue

Affects: fedora-all [bug 906280]

Comment 10 errata-xmlrpc 2013-01-31 21:39:11 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0215 https://rhn.redhat.com/errata/RHSA-2013-0215.html

Note You need to log in before you can comment on or make changes to this bug.