Bugzilla – Bug 916224
VUL-1: CVE-2013-2027: jython: Creates executables class files with wrong permissions
Last modified: 2020-04-01 22:12:35 UTC
Lubomir Rintel 2013-04-03 11:29:50 EDT Description of problem: There are serveral problems with the way Jython creates class cache files, potentially leading to arbitrary code execution or information disclosure. # (umask 000; jython -c 'import xmllib') # ls -l '/usr/share/jython/Lib/xmllib$py.class' -rw-rw-rw-. 1 root root 52874 Apr 3 17:24 /usr/share/jython/Lib/xmllib$py.class Jython does not explicitly set permissions of the class files; therefore with weak umask it creates world-writable files, or discloses sensitive data that would be in a non-world-readable package file. Also, the package writes to /usr/share, which it shouldn't; /var/cache would be more appropriate, but would still lead to a possibility of a content disclosure. The only really portable and secure way to cache class files would be a directory in user's home with 0700 permissions. It is currently even not possible to easily disable the caching, since the configuration file is not marked with %config and resides in /usr/share instead of /etc. References: http://bugs.jython.org/msg8004 https://bugzilla.redhat.com/show_bug.cgi?id=947949 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2027
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2015-03-04. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/60538
This is an autogenerated message for OBS integration: This bug (916224) was mentioned in https://build.opensuse.org/request/show/284056 Factory / jython https://build.opensuse.org/request/show/284057 13.2 / jython https://build.opensuse.org/request/show/284058 13.1 / jython
All should be done, let me know if something is wrong. Also for sle11 I had to tweak a lot the jython-cached-classes.patch compared to other products, so I think it should be right, but if someone could look at it too might be good idea :) I hate when they change the code this lot :)
openSUSE-SU-2015:0269-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 916224 CVE References: CVE-2013-2027 Sources used: openSUSE 13.2 (src): jython-2.2.1-13.4.2 openSUSE 13.1 (src): jython-2.2.1-11.4.2
released for opensuse.