Bugzilla – Bug 843759
VUL-0: CVE-2013-1633: python-setuptools: uses only http
Last modified: 2014-04-14 17:04:21 UTC
CVE-2013-1633 easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product. References: https://bugzilla.redhat.com/show_bug.cgi?id=994182 https://pypi.python.org/pypi/setuptools/0.9.8#changes http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1633 (Not sure if this is python-setuptools)
bugbot adjusting priority
SR #29419 against SLE 11. SLE 10 doesn't seem to have setuptools, and versions in openSUSE are not affected
The SWAMPID for this issue is 56352. This issue was rated as moderate. Please submit fixed packages until 2014-03-06. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
update does currently not do certificate validation ... in strace I see: stat("/etc/pki/tls/certs/ca-bundle.crt", 0x7fff09f66020) = -1 ENOENT (No such file or directory) stat("/etc/ssl/certs/ca-certificates.crt", 0x7fff09f66020) = -1 ENOENT (No such file or directory) stat("/usr/share/ssl/certs/ca-bundle.crt", 0x7fff09f66020) = -1 ENOENT (No such file or directory) stat("/usr/local/share/certs/ca-root.crt", 0x7fff09f66020) = -1 ENOENT (No such file or directory) stat("/etc/ssl/cert.pem", 0x7fff09f66020) = -1 ENOENT (No such file or directory) stat("/System/Library/OpenSSL/certs/cert.pem", 0x7fff09f66020) = -1 ENOENT (No such file or directory) It should open /etc/ssl/certs/xxxxxx.0 files or similar. Pointing the hostname to another one does not result in "bad hostname" errors.
Created attachment 585162 [details] adjust-ssl-patch.patch adjusted patch, if we do not specify any bundle at all it will fallback to the system bundles (and pypi should be verifyable by those).
thanks for the patch (and for fixing my submit). handing over to security again
Update released for: python-setuptools Products: SLE-DESKTOP 11-SP3 (i386, x86_64) SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
Fixed and released. Closing bug.
SUSE-SU-2014:0523-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 843759 CVE References: CVE-2013-1633 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): python-setuptools-0.6c8-10.19.6.1 SUSE Linux Enterprise Desktop 11 SP3 (src): python-setuptools-0.6c8-10.19.6.1