[OE-core] [PATCH 1/1] Python: Fix for CVE-2012-2135 (for denzil)

[Scott Garman]

On 11/30/2012 10:54 AM, Saul Wold wrote:
> On 11/30/2012 03:29 AM, yanjun.zhu wrote:
>> From: "yanjun.zhu" <yanjun.zhu at windriver.com>
>>
>> Reference:http://bugs.python.org/issue14579
>>
>> The utf-16 decoder in Python 3.1 through 3.3 does not update the
>> aligned_end variable after calling the unicode_decode_call_errorhandler
>> function, which allows remote attackers to obtain sensitive information
>> (process memory) or cause a denial of service (memory corruption and
>> crash)
>> via unspecified vectors.
>>
>> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2135
>>
>> [YOCTO #3450]
>>
> Is this for Denzil or is there a 2.7.3 patch for this CVE?  Both Danny
> (1.3) and master are using Python 2.7.3, which does not seem to have
> this CVE fixed yet.

The CVE link above states that the vulnerability exists only in python 
v3.1 - 3.3. That would suggest it would not apply to denzil at all.

I'm thrilled to see more security fixes rolling in, but I'm not sure 
what's going on if they do not apply to the versions of upstream 
software we're shipping.

Scott

-- 
Scott Garman
Embedded Linux Engineer - Yocto Project
Intel Open Source Technology Center