I have Python 2.7 and 3.3 installed on my systems. GLSA 201401-04 is saying my system is vulnerable, and it appears to be only checking if I have version 3.3.2-r1 or lower. This makes me believe that it is detecting version 2.7.5-r3, which according to the bulletin is not vulnerable: http://www.gentoo.org/security/en/glsa/glsa-201401-04.xml Here is an EIX output of my installed versions: [I] dev-lang/python Available versions: (2.6) 2.6.8-r3 ~2.6.9 (2.7) 2.7.5-r3 ~2.7.5-r4 ~2.7.6 (3.2) 3.2.5-r3 (3.3) 3.3.2-r2 ~3.3.3 {-berkdb build doc examples gdbm hardened ipv6 +ncurses +readline sqlite +ssl +threads tk +wide-unicode wininst +xml ELIBC="uclibc"} Installed versions: 2.7.5-r3(2.7)(12:05:31 AM 10/18/2013)(gdbm ipv6 ncurses readline ssl threads wide-unicode xml -berkdb -build -doc -examples -hardened -sqlite -tk -wininst ELIBC="-uclibc") 3.3.2-r2(3.3)(10:59:59 AM 12/02/2013)(gdbm ipv6 ncurses readline ssl threads xml -build -doc -examples -hardened -sqlite -tk -wininst ELIBC="-uclibc") Homepage: http://www.python.org/ Description: An interpreted, interactive, object-oriented programming language Reproducible: Always Steps to Reproduce: 1. emerge -qv python:3.3 python:2.7 2. glsa-check -t all | grep -iv "not affected" Actual Results: This system is affected by the following GLSAs: 201401-04 Expected Results: No output
*** This bug has been marked as a duplicate of bug 497322 ***
Sorry about that. I did search, but I didn't see it.
