Your message dated Fri, 18 Feb 2005 19:33:43 -0500
with message-id <[EMAIL PROTECTED]>
and subject line closing
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 11 Feb 2005 20:40:44 +0000
>From [EMAIL PROTECTED] Fri Feb 11 12:40:44 2005
Return-path: <[EMAIL PROTECTED]>
Received: from kitenet.net [64.62.161.42] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Czham-0002DW-00; Fri, 11 Feb 2005 12:40:44 -0800
Received: from dragon.kitenet.net (unknown [66.168.94.144])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
by kitenet.net (Postfix) with ESMTP id B4D961803E
for <[EMAIL PROTECTED]>; Fri, 11 Feb 2005 20:40:43 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
id 84D5B6E20E; Fri, 11 Feb 2005 15:43:01 -0500 (EST)
Date: Fri, 11 Feb 2005 15:43:00 -0500
From: Joey Hess <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: FWD: [USN-80-1] mod_python vulnerability
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="yVhtmJPUSI46BTXb"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--yVhtmJPUSI46BTXb
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: libapache2-mod-python
Version: 3.1.3-2.2
Severity: serious
Tags: security patch
I suppose we're vulnerable to this hole. Here's the patch red hat used:
https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=3D110440&action=3Dvi=
ew
I'm not sure if the information discolsure is release critical, so this
bug report could be downgraded. Or just quickly fixed. ;-)
----- Forwarded message from Martin Pitt <[EMAIL PROTECTED]> -----
=46rom: Martin Pitt <[EMAIL PROTECTED]>
Date: Fri, 11 Feb 2005 10:41:39 +0100
To: [EMAIL PROTECTED]
Cc: full-disclosure@lists.netsys.com, bugtraq@securityfocus.com
Subject: [USN-80-1] mod_python vulnerability
User-Agent: Mutt/1.5.6+20040907i
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-80-1 February 11, 2005
libapache2-mod-python vulnerabilities
CAN-2005-0088
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
The following packages are affected:
libapache2-mod-python2.2
libapache2-mod-python2.3
The problem can be corrected by upgrading the affected package to
version 3.1.3-1ubuntu3.2. After a standard system upgrade you need to
restart the Apache 2 web server using
sudo /etc/init.d/apache2 restart
to effect the necessary changes.
Details follow:
Graham Dumpleton discovered an information disclosure in the
"publisher" handle of mod_python. By requesting a carefully crafted
URL for a published module page, anybody can obtain extra information
about internal variables, objects, and other information which is not
intended to be visible.
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python_3.1.3-1ubuntu3.2.diff.gz
Size/MD5: 24067 485183927dd680eedb351cedbd0bb882
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python_3.1.3-1ubuntu3.2.dsc
Size/MD5: 806 3b141dd6a13c2abc0c1780ff8d9c34aa
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python_3.1.3.orig.tar.gz
Size/MD5: 293548 2e1983e35edd428f308b0dfeb1c23bfe
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python-doc_3.1.3-1ubuntu3.2_all.deb
Size/MD5: 100700 6890472b77b13191bf5106123bbebc6c
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python_3.1.3-1ubuntu3.2_all.deb
Size/MD5: 12462 b48ab5f2c09c47bfe0c7c02243766c4f
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-pyt=
hon/libapache2-mod-python2.2_3.1.3-1ubuntu3.2_amd64.deb
Size/MD5: 87564 e331d0cbb7aacadc64ef44d41d326587
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python2.3_3.1.3-1ubuntu3.2_amd64.deb
Size/MD5: 87650 0dcbdb227cae1b4721c4b8e0454b4ea6
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-pyt=
hon/libapache2-mod-python2.2_3.1.3-1ubuntu3.2_i386.deb
Size/MD5: 80502 003d29054ae210f2f81826bac8de7856
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python2.3_3.1.3-1ubuntu3.2_i386.deb
Size/MD5: 80538 1813380c5c39583e9311e117f2823aca
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-pyt=
hon/libapache2-mod-python2.2_3.1.3-1ubuntu3.2_powerpc.deb
Size/MD5: 85218 d56d5f3a5cda43096dda9d1d7fc3fc0b
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/=
libapache2-mod-python2.3_3.1.3-1ubuntu3.2_powerpc.deb
Size/MD5: 85350 9df8b87f95570137d2402818a252b38d
----- End forwarded message -----
--=20
see shy jo
--yVhtmJPUSI46BTXb
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCDRjUd8HHehbQuO8RAvM1AJ9fxGiihnKDoWgoQTGcZ3OklPw1iACgxvyB
XZupE8QB1jo8USxiOgwGuRc=
=wy8D
-----END PGP SIGNATURE-----
--yVhtmJPUSI46BTXb--
---------------------------------------
Received: (at 294835-done) by bugs.debian.org; 19 Feb 2005 00:31:21 +0000
>From [EMAIL PROTECTED] Fri Feb 18 16:31:21 2005
Return-path: <[EMAIL PROTECTED]>
Received: from kitenet.net [64.62.161.42] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D2IWn-0001qc-00; Fri, 18 Feb 2005 16:31:21 -0800
Received: from dragon.kitenet.net (unknown [66.168.94.144])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
by kitenet.net (Postfix) with ESMTP id CACCE17F02
for <[EMAIL PROTECTED]>; Sat, 19 Feb 2005 00:31:20 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
id 00FBD6F031; Fri, 18 Feb 2005 19:33:44 -0500 (EST)
Date: Fri, 18 Feb 2005 19:33:43 -0500
From: Joey Hess <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: closing
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="9jxsPFA5p3P2qPhR"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-2.0 required=4.0 tests=BAYES_00,ONEWORD autolearn=no
version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--9jxsPFA5p3P2qPhR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
This was fixed in version 3.1.3-3
--=20
see shy jo
--9jxsPFA5p3P2qPhR
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCFolnd8HHehbQuO8RAvy9AKCkFrJDr05tG/0/DCGYe7YyLXpRKgCg24nX
UHFldAy59D0EHWrlxQ1KXUI=
=nxW9
-----END PGP SIGNATURE-----
--9jxsPFA5p3P2qPhR--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
