Bug 916890 (CVE-2014-3539) - VUL-1: CVE-2014-3539 python-rope: pickle.load of remotely supplied data with no authentication required
Summary: VUL-1: CVE-2014-3539 python-rope: pickle.load of remotely supplied data with ...
Status: RESOLVED FIXED
Alias: CVE-2014-3539
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Jan Matejek
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/113610/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-09 11:42 UTC by Johannes Segitz
Modified: 2015-03-03 16:05 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2015-02-09 11:42:43 UTC 
rh#1116485

Kurt Seifried and Vasyl Kaigorodov of Red Hat Product Security report:
pickle.load of remotely supplied data with no auth, RCE

See RH bug for details.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1116485
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3539
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3539
Comment 1 Swamp Workflow Management 2015-02-09 23:04:30 UTC 
bugbot adjusting priority
Comment 2 Victor Pereira 2015-02-10 15:50:41 UTC 
The author as described here: https://github.com/python-rope/rope/issues/105

worked already in a solution https://gitorious.org/rope/rope/commits/58b1c31c33842001ee0cac0078861e5f6567da6a
Comment 3 Jan Matejek 2015-02-23 14:54:56 UTC 
Note that the issue is not fully fixed by the upstream patch. The most important change is that the listening server is now restricted to localhost, but still open to other local users without authentication.
The patch also disables the vulnerable feature by default, but this can be overriden in custom config, and it's possible that this will remain active in cases where user already has the custom config with this enabled.

Still worth the update for the localhost restriction. For Factory and new installs, disabling the feature by default should be sufficient, and so we can wait for upstream to deliver a proper fix.
Comment 4 Bernhard Wiedemann 2015-02-23 15:00:07 UTC 
This is an autogenerated message for OBS integration:
This bug (916890) was mentioned in
https://build.opensuse.org/request/show/287349 13.2+13.1 / python-rope
Comment 6 Marcus Meissner 2015-03-03 15:10:25 UTC 
was released
Comment 7 Swamp Workflow Management 2015-03-03 16:05:30 UTC 
openSUSE-SU-2015:0413-1: An update that fixes one vulnerability is now available.

Category: security (low)
Bug References: 916890
CVE References: CVE-2014-3539
Sources used:
openSUSE 13.2 (src):    python-rope-0.9.4-8.4.1
openSUSE 13.1 (src):    python-rope-0.9.4-6.4.1