[ MDVSA-2013:227 ] python-setuptools

2013-09-11T00:00:00
ID SECURITYVULNS:DOC:29810
Type securityvulns
Reporter Securityvulns
Modified 2013-09-11T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2013:227 http://www.mandriva.com/en/support/security/


Package : python-setuptools Date : September 9, 2013 Affected: Business Server 1.0, Enterprise Server 5.0


Problem Description:

A vulnerability has been discovered and corrected in python-setuptools/python-virtualenv:

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product (CVE-2013-1633).

The updated python-setuptools packages has been upgraded to the 0.9.8 version and the python-virtualenv packages has been upgraded to the 1.10.1 version which is not vulnerable to this issue.


References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1633


Updated Packages:

Mandriva Enterprise Server 5: e1cb29da242ab6e8e1159d3944222d8d mes5/i586/python-pkg-resources-0.9.8-0.1mdvmes5.2.noarch.rpm 7ab6f335508a6492632c6fc03a5ecdcc mes5/i586/python-setuptools-0.9.8-0.1mdvmes5.2.noarch.rpm 258487e101cef7b253f735efb0510cbf mes5/i586/python-virtualenv-1.10.1-0.1mdvmes5.2.noarch.rpm e666fcfc1c64f270a4e13d023e270a9d mes5/SRPMS/python-setuptools-0.9.8-0.1mdvmes5.2.src.rpm 7041c005b2bdb503d949b07c37388cb6 mes5/SRPMS/python-virtualenv-1.10.1-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64: 1c2fd8142ac903fdad66a6f4f2feed0f mes5/x86_64/python-pkg-resources-0.9.8-0.1mdvmes5.2.noarch.rpm f1e480dd21ff6c5c9fbed415e7a7bdf4 mes5/x86_64/python-setuptools-0.9.8-0.1mdvmes5.2.noarch.rpm f309ac0531583675a1db38117fc25d53 mes5/x86_64/python-virtualenv-1.10.1-0.1mdvmes5.2.noarch.rpm e666fcfc1c64f270a4e13d023e270a9d mes5/SRPMS/python-setuptools-0.9.8-0.1mdvmes5.2.src.rpm 7041c005b2bdb503d949b07c37388cb6 mes5/SRPMS/python-virtualenv-1.10.1-0.1mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64: 65a932783bd31f9b08c589e8d2759b1a mbs1/x86_64/python-pkg-resources-0.9.8-1.1.mbs1.noarch.rpm db9923d3d8f0a3091a359f241376b96a mbs1/x86_64/python-setuptools-0.9.8-1.1.mbs1.noarch.rpm 2c2de1f8c488e47229c9814723e1162a mbs1/x86_64/python-virtualenv-1.10.1-1.mbs1.noarch.rpm 61b5bca18ac1dc48e4af0961f45f3672 mbs1/SRPMS/python-setuptools-0.9.8-1.1.mbs1.src.rpm 03fbed23bdef2a9c667fc8e585a030aa mbs1/SRPMS/python-virtualenv-1.10.1-1.mbs1.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSLZCjmqjQ0CJFipgRAnzIAJsGW/9oKmcMG7w5rYgh2WviBPNIEACgt+eZ DL5xgKWU4weNpgvabeCT6d4= =0G1r -----END PGP SIGNATURE-----