| Summary: | <www-servers/tornado-4.4.2-r1: cookie parser vulnerability, bypass XSRF protection | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Brian Dolbec (RETIRED) <dolsen> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | alunduil, dolsen, python |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.tornadoweb.org/en/stable/releases/v4.4.2.html | ||
| Whiteboard: | B4 [noglsa] | ||
| Package list: |
=dev-python/backports-ssl-match-hostname-3.5.0.1-r1
=www-servers/tornado-4.4.2-r1
|
Runtime testing required: | --- |
| Bug Depends on: | |||
| Bug Blocks: | 530622 | ||
|
Description
Brian Dolbec (RETIRED)
2016-10-22 00:13:49 UTC
More detailed info is available in commit: https://github.com/tornadoweb/tornado/commit/cb247cb8db7903fda0ca26531c1526e895e10800 which links to: https://hackerone.com/reports/26647 with details of the original vulnerability. I've asked for clarification of the affected versions. upstream bug: https://github.com/tornadoweb/tornado/issues/1865 I've now heard back from upstream. All previous versions are considered vulnerable. This vulnerability is not specific to the 4.4 or even the 4.x series. So, I've opened a fast stabilization bug for the new version. I updated the 2 pkgs versions needed for stabilization, removed the vulnerable versions, and made a PR against the tree to shake out any tree breakage. https://github.com/gentoo/gentoo/pull/2742 All tests passed, so no tree breakage reported. *** Bug 598956 has been marked as a duplicate of this bug. *** *** Bug 598948 has been marked as a duplicate of this bug. *** (In reply to Brian Dolbec from comment #3) > So, I've opened a fast stabilization bug for the new version. Why? Really. We don't need more bug reports. (In reply to Jeroen Roovers from comment #7) > (In reply to Brian Dolbec from comment #3) > > So, I've opened a fast stabilization bug for the new version. > > Why? Really. We don't need more bug reports. So, we don't need to stabilize anything, just close the stabilize bugs and ignore the security vulnerability? With nothing to indicate that this version needs to be stabilized? ... I Give up (In reply to Brian Dolbec from comment #8) > (In reply to Jeroen Roovers from comment #7) > > (In reply to Brian Dolbec from comment #3) > > > So, I've opened a fast stabilization bug for the new version. > > > > Why? Really. We don't need more bug reports. > > So, we don't need to stabilize anything, just close the stabilize bugs and > ignore the security vulnerability? With nothing to indicate that this > version needs to be stabilized? > > > ... > > I Give up Brian, the established process when dealing with security vulnerabilities is that all work is done within the security bug. The report is made detailing the vulnerability as you did here, the package is dealt with accordingly, the maintainer determines whether to stabilize or hold for testing, then arches are CC'ed accordingly for stabilization. This includes whiteboard updates along the way, which is not your responsibility but helps in the long run if you are willing. Please see [1] for the complete overview of the security process. [1]: https://wiki.gentoo.org/wiki/Project:Security/GLSA_Coordinator_Guide This guideline is of course for GLSA coordinators/security project members, but it will help you understand our process so we may better assist fellow developers and maintainers. Additionally, the arch teams generally prioritize security related bugs in their workflows. So ensuring it is assigned to security and the maintainers are CC'ed ensures that workflow is effective. I hope this helps. -Aaron amd64 stable Stable for HPPA PPC64. Stable on alpha. x86 stable arm stable An automated check of this bug failed - repoman reported dependency errors (39 lines truncated):
> dependency.bad www-servers/tornado/tornado-4.4.2-r1.ebuild: DEPEND: ia64(default/linux/ia64/13.0) ['dev-python/backports-ssl-match-hostname[python_targets_python2_7(-)?,python_targets_python3_4(-)?,python_targets_python3_5(-)?,-python_single_target_python2_7(-),-python_single_target_python3_4(-),-python_single_target_python3_5(-)]']
> dependency.bad www-servers/tornado/tornado-4.4.2-r1.ebuild: RDEPEND: ia64(default/linux/ia64/13.0) ['dev-python/backports-ssl-match-hostname[python_targets_python2_7(-)?,python_targets_python3_4(-)?,python_targets_python3_5(-)?,-python_single_target_python2_7(-),-python_single_target_python3_4(-),-python_single_target_python3_5(-)]']
> dependency.bad www-servers/tornado/tornado-4.4.2-r1.ebuild: DEPEND: ia64(default/linux/ia64/13.0/desktop) ['dev-python/backports-ssl-match-hostname[python_targets_python2_7(-)?,python_targets_python3_4(-)?,python_targets_python3_5(-)?,-python_single_target_python2_7(-),-python_single_target_python3_4(-),-python_single_target_python3_5(-)]']
ppc stable ia64 stable. Maintainer(s), please cleanup. Security, please vote. Done, vulnerable versions removed. GLSA Vote: No |