279720 – <dev-python/django-1.0.3: Disclosure of private files (CVE-2009-2659)

Bug 279720 - <dev-python/django-1.0.3: Disclosure of private files (CVE-2009-2659)

Summary: <dev-python/django-1.0.3: Disclosure of private files (CVE-2009-2659)

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High trivial (vote)
Assignee:	Gentoo Security

URL:	http://www.djangoproject.com/weblog/2...
Whiteboard:	~3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2009-07-30 17:42 UTC by Matt Summers (RETIRED)
Modified:	2009-08-05 11:34 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
here is the updated ebuild, with fixes now that tests are included in the release tarball once again. (django-1.0.3.ebuild,2.53 KB, text/plain) 2009-07-30 17:42 UTC, Matt Summers (RETIRED)	no flags	Details
diff (django-1.0.2-r1_to_django-1.0.3.ebuild.diff,382 bytes, text/plain) 2009-07-31 15:03 UTC, Matt Summers (RETIRED)	no flags	Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Matt Summers (RETIRED) gentoo-dev

2009-07-30 17:42:02 UTC

Some vulnerabilities in the development server have prompted this release. The issues relate specifically to handling static media files.

Reproducible: Always

Comment 1 Matt Summers (RETIRED) gentoo-dev

2009-07-30 17:42:55 UTC

Created attachment 199673 [details]
here is the updated ebuild, with fixes now that tests are included in the release tarball once again.

enjoy

Comment 2 Tobias Heinlein (RETIRED) gentoo-dev

2009-07-30 18:20:14 UTC

Matt, thanks for the report. Python team, please proceed.

Comment 3 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev

2009-07-31 00:30:46 UTC

(In reply to comment #1)

Please attach unidiff patches instead of whole ebuilds.

Comment 4 Matt Summers (RETIRED) gentoo-dev

2009-07-31 15:03:25 UTC

Created attachment 199749 [details]
diff

including fix for upstream tarball name change, and removal of tests workaround as they are now, correctly, included in the release.

Thanks to Arfrever for the assist.

Comment 5 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev

2009-08-02 19:30:53 UTC

Fixed.

Comment 6 Michał Bartoszkiewicz 2009-08-03 02:25:18 UTC

Parentheses in RDEPEND in the ebuild in the tree seem to be wrong:
    sqlite? ( || (
        >=dev-lang/python-2.5[sqlite] )
        ( dev-python/pysqlite:2 <dev-lang/python-2.5 )
    )
(and similar for test in DEPEND)
I think there should be no parenthesis after >=dev-lang/python-2.5[sqlite] -- now portage wants to install python-2.4 and pysqlite in addition to python-2.6 I have already installed.

Comment 7 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev

2009-08-03 05:10:50 UTC

(In reply to comment #6)

Fixed.

Comment 8 Alex Legler (RETIRED) archtester

2009-08-05 11:34:08 UTC

CVE-2009-2659 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2659):
  The Admin media handler in core/servers/basehttp.py in Django 1.0 and
  0.96 does not properly map URL requests to expected "static media
  files," which allows remote attackers to conduct directory traversal
  attacks and read arbitrary files via a crafted URL.