Bug 19189

Summary:	python, python3 new security issue CVE-2016-1000110
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, makowski.mageia, pterjan, sysadmin-bugs
Version:	5	Keywords:	validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/697141/
Whiteboard:	has_procedure MGA5-64-OK advisory
Source RPM:	python, python3	CVE:	CVE-2016-1000110
Status comment:
Attachments:	test case

Description David Walser 2016-08-12 19:30:16 CEST

Fedora has issued advisory on August 11:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZUW7L4QUAC5FZ6DWR4NL7TNTEM73DQYU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2YW45Y2P67PX7CI2K6WVFJTQTUIO452O/

This is another instance of the "httpoxy" problem.

Philippe Makowski 2016-08-13 16:02:32 CEST

CVE: (none) => CVE-2016-1000110
Version: Cauldron => 5

Comment 1 Philippe Makowski 2016-08-13 18:48:08 CEST

Python3 and Python updated in Cauldron


Advisory:
========================

Updated python and python3 packages fix security vulnerability:
Fix for CVE-2016-1000110 HTTPoxy attack

Many software projects and vendors have implemented support for the âProxyâ request header in their respective CGI implementations and languages by creating the âHTTP_PROXYâ environmental variable based on the header value. When this variable is used (in many cases automatically by various HTTP client libraries) any outgoing requests generated in turn from the attackers original request can be redirected to an attacker controlled proxy. This allows attackers to view potentially sensitive information, reply with malformed data, or to hold connections open causing a potential denial of service.

References: 
https://bugzilla.redhat.com/show_bug.cgi?id=1359175
http://lwn.net/Vulnerabilities/697141/
https://bugs.python.org/issue27568

========================

Updated packages in core/updates_testing:
========================
python3-3.4.3-1.5.mga5
libpython3.4-3.4.3-1.5.mga5.i586
libpython3-devel-3.4.3-1.5.mga5
python3-docs-3.4.3-1.5.mga5
tkinter3-3.4.3-1.5.mga5
tkinter3-apps-3.4.3-1.5.mga5

python-2.7.9-2.4.mga5
libpython2.7-2.7.9-2.4.mga5
libpython-devel-2.7.9-2.4.mga5
python-docs-2.7.9-2.4.mga5
tkinter-2.7.9-2.4.mga5
tkinter-apps-2.7.9-2.4.mga5

from 
python3-3.2.3-1.3.mga5.src.rpm
python-2.7.9-2.4.mga5.src.rpm

Assignee: makowski.mageia => qa-bugs

Comment 2 Philippe Makowski 2016-08-17 22:17:44 CEST

Created attachment 8350 [details]
test case

Comment 3 Philippe Makowski 2016-08-17 22:20:03 CEST

before update :
$ python CVE-2016-1000110.py 
F
======================================================================
FAIL: test_proxy_cgi_ignore (__main__.TestCVE)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "CVE-2016-1000110.py", line 23, in test_proxy_cgi_ignore
    self.assertNotIn('http', proxies)
AssertionError: 'http' unexpectedly found in {'http': 'http://somewhere:3128'}

----------------------------------------------------------------------
Ran 1 test in 0.000s

FAILED (failures=1)

$ python3 CVE-2016-1000110.py 
F
======================================================================
FAIL: test_proxy_cgi_ignore (__main__.TestCVE)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "CVE-2016-1000110.py", line 23, in test_proxy_cgi_ignore
    self.assertNotIn('http', proxies)
AssertionError: 'http' unexpectedly found in {'http': 'http://somewhere:3128'}

----------------------------------------------------------------------
Ran 1 test in 0.001s

FAILED (failures=1)

after update :

$ python CVE-2016-1000110.py 
.
----------------------------------------------------------------------
Ran 1 test in 0.000s

OK

$ python3 CVE-2016-1000110.py 
.
----------------------------------------------------------------------
Ran 1 test in 0.001s

OK

CC: (none) => makowski.mageia
Whiteboard: (none) => has_procedure MGA5-64-OK

Dave Hodgins 2016-08-18 23:50:36 CEST

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-64-OK => has_procedure MGA5-64-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 4 Pascal Terjan 2016-08-31 17:22:28 CEST

Advisory seems to list wrong package:

Checking SRPMsâ¦                       â (5/core/python3-3.2.3-1.3.mga5)

CC: (none) => pterjan

Comment 5 Rémi Verschelde 2016-08-31 19:14:22 CEST

Advisory fixed, there was a typo in comment 1 which was reproduced in SVN.

Comment 6 Mageia Robot 2016-08-31 19:34:52 CEST

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0296.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED