Bug 497426 – GLSA 201401-04: false positive on python version <dev-lang/python-3.3

• Product: Gentoo Security
• Status: RESOLVED DUPLICATE

[Description Adam Randall 2014-01-07 18:34:47 UTC]

I have Python 2.7 and 3.3 installed on my systems. GLSA 201401-04 is saying my system is vulnerable, and it appears to be only checking if I have version 3.3.2-r1 or lower. This makes me believe that it is detecting version 2.7.5-r3, which according to the bulletin is not vulnerable:

http://www.gentoo.org/security/en/glsa/glsa-201401-04.xml

Here is an EIX output of my installed versions:

[I] dev-lang/python
     Available versions:
     (2.6)  2.6.8-r3 ~2.6.9
     (2.7)  2.7.5-r3 ~2.7.5-r4 ~2.7.6
     (3.2)  3.2.5-r3
     (3.3)  3.3.2-r2 ~3.3.3
       {-berkdb build doc examples gdbm hardened ipv6 +ncurses +readline sqlite +ssl +threads tk +wide-unicode wininst +xml ELIBC="uclibc"}
     Installed versions:  2.7.5-r3(2.7)(12:05:31 AM 10/18/2013)(gdbm ipv6 ncurses readline ssl threads wide-unicode xml -berkdb -build -doc -examples -hardened -sqlite -tk -wininst ELIBC="-uclibc") 3.3.2-r2(3.3)(10:59:59 AM 12/02/2013)(gdbm ipv6 ncurses readline ssl threads xml -build -doc -examples -hardened -sqlite -tk -wininst ELIBC="-uclibc")
     Homepage:            http://www.python.org/
     Description:         An interpreted, interactive, object-oriented programming language


Reproducible: Always

Steps to Reproduce:
1. emerge -qv python:3.3 python:2.7
2. glsa-check -t all | grep -iv "not affected"
Actual Results:  
This system is affected by the following GLSAs:
201401-04

Expected Results:  
No output

[Comment 1 Alex Legler (RETIRED) 2014-01-07 18:36:49 UTC]

*** This bug has been marked as a duplicate of bug 497322 ***

[Comment 2 Adam Randall 2014-01-07 18:39:12 UTC]

Sorry about that. I did search, but I didn't see it.