BugTraq
[ MDVSA-2013:227 ] python-setuptools Sep 09 2013 12:18PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:227
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : python-setuptools
Date : September 9, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability has been discovered and corrected in
python-setuptools/python-virtualenv:

easy_install in setuptools before 0.7 uses HTTP to retrieve packages
from the PyPI repository, and does not perform integrity checks on
package contents, which allows man-in-the-middle attackers to execute
arbitrary code via a crafted response to the default use of the product
(CVE-2013-1633).

The updated python-setuptools packages has been upgraded to the 0.9.8
version and the python-virtualenv packages has been upgraded to the
1.10.1 version which is not vulnerable to this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1633
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
e1cb29da242ab6e8e1159d3944222d8d mes5/i586/python-pkg-resources-0.9.8-0.1mdvmes5.2.noarch.rpm
7ab6f335508a6492632c6fc03a5ecdcc mes5/i586/python-setuptools-0.9.8-0.1mdvmes5.2.noarch.rpm
258487e101cef7b253f735efb0510cbf mes5/i586/python-virtualenv-1.10.1-0.1mdvmes5.2.noarch.rpm
e666fcfc1c64f270a4e13d023e270a9d mes5/SRPMS/python-setuptools-0.9.8-0.1mdvmes5.2.src.rpm
7041c005b2bdb503d949b07c37388cb6 mes5/SRPMS/python-virtualenv-1.10.1-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
1c2fd8142ac903fdad66a6f4f2feed0f mes5/x86_64/python-pkg-resources-0.9.8-0.1mdvmes5.2.noarch.rpm
f1e480dd21ff6c5c9fbed415e7a7bdf4 mes5/x86_64/python-setuptools-0.9.8-0.1mdvmes5.2.noarch.rpm
f309ac0531583675a1db38117fc25d53 mes5/x86_64/python-virtualenv-1.10.1-0.1mdvmes5.2.noarch.rpm
e666fcfc1c64f270a4e13d023e270a9d mes5/SRPMS/python-setuptools-0.9.8-0.1mdvmes5.2.src.rpm
7041c005b2bdb503d949b07c37388cb6 mes5/SRPMS/python-virtualenv-1.10.1-0.1mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
65a932783bd31f9b08c589e8d2759b1a mbs1/x86_64/python-pkg-resources-0.9.8-1.1.mbs1.noarch.rpm
db9923d3d8f0a3091a359f241376b96a mbs1/x86_64/python-setuptools-0.9.8-1.1.mbs1.noarch.rpm
2c2de1f8c488e47229c9814723e1162a mbs1/x86_64/python-virtualenv-1.10.1-1.mbs1.noarch.rpm
61b5bca18ac1dc48e4af0961f45f3672 mbs1/SRPMS/python-setuptools-0.9.8-1.1.mbs1.src.rpm
03fbed23bdef2a9c667fc8e585a030aa mbs1/SRPMS/python-virtualenv-1.10.1-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSLZCjmqjQ0CJFipgRAnzIAJsGW/9oKmcMG7w5rYgh2WviBPNIEACgt+eZ
DL5xgKWU4weNpgvabeCT6d4=
=0G1r
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus