Bug 554868 – <dev-python/ipython-3.2.1: CSRF validation (CVE-2015-5607)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2015-07-14 10:06:27 UTC]

From ${URL} :

Software name: IPython notebook
Type of vulnerability: CSRF
Attack outcome: Possible remote execution
Patches:
  2.x:
https://github.com/ipython/ipython/commit/a05fe052a18810e92d9be8c1185952c13fe4e5b0
  3.x:
https://github.com/ipython/ipython/commit/1415a9710407e7c14900531813c15ba6165f0816

Affected versions: 0.12 ≤ version ≤ 3.2.0

Summary: POST requests exposed via the IPython REST API are vulnerable to
cross-site request forgery (CSRF). Web pages on different domains can make
non-AJAX POST requests to known IPython URLs, and IPython will honor them.
The user's browser will automatically send IPython cookies along with the
requests. The response is blocked by the Same-Origin Policy, but the
request isn't.

API paths with issues:

* POST /api/contents/<path>/<file>
* POST /api/contents/<path>/<file>/checkpoints
* POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>
* POST /api/kernels
* POST /api/kernels/<kernel_id>/<action>
* POST /api/sessions
* POST /api/clusters/<cluster_id>/<action>

Mitigations:

Upgrade to IPython 3.2.1. If using pip,



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Ian Delaney (RETIRED) 2015-07-18 07:03:04 UTC]

*ipython-3.2.1 (18 Jul 2015)

  18 Jul 2015; Ian Delaney <[e-mail]> +ipython-3.2.1.ebuild:
  bump wrt security bug #541628, minor tidy to ebuild in deps.

I suggest go straight to stabilisation. There is a glitch in the testsuite under python3.4 which I recommend as not blocking going stable. It has been filed upstream already. 

KEYWORDS="~amd64 ~arm ~ppc64 ~x86 and ppc is also required

Pleas refrain from content such as "Upgrade to IPython 3.2.1. If using pip," which mentions use of pip.

[Comment 2 Yury German 2015-08-09 03:02:16 UTC]

Arches, please test and mark stable:

=dev-python/ipython-3.2.1

Target Keywords : "amd64 arm ppc ppc64 x86"

Thank you!

[Comment 3 Jeroen Roovers (RETIRED) 2015-08-15 09:24:14 UTC]

Stable for PPC64.

[Comment 4 Agostino Sarubbo 2015-08-25 07:30:51 UTC]

amd64 stable

[Comment 5 Agostino Sarubbo 2015-08-25 07:31:32 UTC]

x86 stable

[Comment 6 Agostino Sarubbo 2015-08-26 07:31:23 UTC]

ppc stable

[Comment 7 Yury German 2015-10-10 03:05:31 UTC]

ping on arm stabilization.

[Comment 8 Markus Meier 2015-10-10 08:57:58 UTC]

arm stable, all arches done.

[Comment 9 Justin Lecher (RETIRED) 2015-10-10 15:49:55 UTC]

commit 664e0d0f43e4f3ddc8033a3b6a3d6d57d0590425
Author: Justin Lecher <[e-mail]>
Date:   Sat Oct 10 17:48:42 2015 +0200

    dev-python/ipython: Drop vulnerable version (CVE-2015-5607, CVE-2015-7337)

    Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=554868
    Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=560708

    Package-Manager: portage-2.2.23
    Signed-off-by: Justin Lecher <[e-mail]>

    https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=664e0d0f43e4f3ddc8033a3b6a3d6d57d0590425

[Comment 10 Justin Lecher (RETIRED) 2015-10-10 15:50:08 UTC]

@sec, all clean now.

[Comment 11 Kristian Fiskerstrand (RETIRED) 2015-10-10 15:51:54 UTC]

(In reply to Justin Lecher from comment #10)
> @sec, all clean now.

Thanks, closing