Bug 791565 – <sys-process/glances-3.1.7: unsafe XML parsing

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-05-23 02:50:45 UTC]

Issue includes Bandit output:


        Issue: [B411:blacklist] Using Fault to parse untrusted XML data is known to be vulnerable to XML attacks. Use defused.xmlrpc.monkey_patch() function to monkey-patch xmlrpclib and mitigate XML vulnerabilities.
        Severity: High Confidence: High
        Location: glances/compat.py:91
        90 from SimpleXMLRPCServer import SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
        91 from xmlrpclib import Fault, ProtocolError, ServerProxy, Transport
        92 from urllib2 import urlopen, URLError


Fix in 3.1.7, please bump.

[Comment 1 Georgy Yakovlev 2021-06-12 03:00:50 UTC]

bumped in https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=429217398964cc9e867dd802b4b98c677764a42e

[Comment 2 John Helmert III 2021-06-12 03:12:04 UTC]

Thank you!

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-10 07:44:27 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: sys-process/glances-3.1.7

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-10 12:24:37 UTC Comment hidden (obsolete)]

All sanity-check issues have been resolved

[Comment 5 Agostino Sarubbo 2021-07-11 08:58:44 UTC]

amd64 stable

[Comment 6 Sam James 2021-07-11 20:51:58 UTC]

x86 done

[Comment 7 Sam James 2021-07-12 21:56:08 UTC]

arm64 done

[Comment 8 Sam James 2021-07-13 04:01:51 UTC]

arm done

[Comment 9 Georgy Yakovlev 2021-07-13 05:52:31 UTC]

ppc64 done, last arch

[Comment 10 Larry the Git Cow 2021-07-13 05:52:59 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9924df5a5674be8968875b806ad309d3662df0b5

commit 9924df5a5674be8968875b806ad309d3662df0b5
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2021-07-13 05:52:29 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2021-07-13 05:52:29 +0000

    sys-process/glances: drop 3.1.6.2
    
    Bug: https://bugs.gentoo.org/791565
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 sys-process/glances/Manifest               |  1 -
 sys-process/glances/glances-3.1.6.2.ebuild | 87 ------------------------------
 2 files changed, 88 deletions(-)

[Comment 11 NATTkA bot 2021-12-21 03:52:53 UTC]

Unable to check for sanity:

> no match for package: sys-process/glances-3.2.1

[Comment 12 Georgy Yakovlev 2021-12-21 04:18:06 UTC]

cleanup done.

[Comment 13 Larry the Git Cow 2024-02-26 12:07:42 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=b1cfcda7a8b39747e2e84f98c62aa12c3804f4e9

commit b1cfcda7a8b39747e2e84f98c62aa12c3804f4e9
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-02-26 12:07:09 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-02-26 12:07:31 +0000

    [ GLSA 202402-30 ] Glances: Arbitrary Code Execution
    
    Bug: https://bugs.gentoo.org/791565
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202402-30.xml | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)