Re: On tomcat FTBFS.

2019-08-06 Thread Sylvain Beucler 
Hi Markus,

I'm investigating tomcat8's FTBFS and I confirm Abhijith's findings in a
Jessie VM:

- test catalina/connector/TestSendFile.java fails with nio2 connector
but is not reliable and will report success ~1 out of 10 even with lots
of exceptions; catalina.log will report header parsing error and return 400

- it passes reliably without CVE-2017-5647.patch

- the test certificate did expire on 2019-02-27 but changing the date to
2019-01-01 and rebuilding does not impact these results
(incidentally the test certs seems to depend on an external CA
ca-test.tomcat.apache.org, fixing the certs will require switching to
the new-style local CA in tomcat8 - if fixing the certs is needed)

As you fixed CVE-2017-5647 as well as generated the last jessie upload,
I would be interested in your take on this :)
TestSendFile only got trivial changes, so I guess I'll look for a fix in
later changes affecting files modified by CVE-2017-5647.
Still, I'm surprised updates were built given this situation - did
everybody got lucky with the flacky test or did I miss something?

Cheers!
Sylvain

On 27/07/2019 20:30, Abhijith PA wrote:
> Hi,
>
>
> I don't think the link you gave on commit [fe932dd39d] is the reason for
> FTBFS. I tried building on a VM that matches the certificate date and it
> was successful. I also tried disabling all ssl related tests and was fine.
>
> While doing these all I found TestSendFile test is the culprit. In
> CVE-2017-5647 security patch a good amount of changes is applied for
> SendFile*.java and *Nio2*.java. These are mostly about conditions on how
> long the socket of sendfile keep active and to take away from it. But I
> couldn't see any those change in its test file. Please take a look on
> the attached patch. :)
>
>
> --abhijith

Accepted python-django 1.7.11-1+deb8u7 (source all) into oldoldstable

2019-08-06 Thread Chris Lamb 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Tue, 06 Aug 2019 10:34:56 +0100
Source: python-django
Binary: python-django python3-django python-django-common python-django-doc
Built-For-Profiles: nocheck
Architecture: source all
Version: 1.7.11-1+deb8u7
Distribution: jessie-security
Urgency: high
Maintainer: Debian Python Modules Team 

Changed-By: Chris Lamb 
Description:
 python-django - High-level Python web development framework (Python 2 version)
 python-django-common - High-level Python web development framework (common)
 python-django-doc - High-level Python web development framework (documentation)
 python3-django - High-level Python web development framework (Python 3 version)
Closes: 934026
Changes:
 python-django (1.7.11-1+deb8u7) jessie-security; urgency=high
 .
   * Backport two security patches from upstream. (Closes: #934026)
 
 .
 - CVE-2019-14232: Prevent a possible denial-of-service in
   django.utils.text.Truncator.
 .
   If django.utils.text.Truncator's chars() and words() methods were passed
   the html=True argument, they were extremely slow to evaluate certain 
inputs
   due to a catastrophic backtracking vulnerability in a regular expression.
   The chars() and words() methods are used to implement the
   truncatechars_html and truncatewords_html template filters, which were 
thus
   vulnerable.
 .
   The regular expressions used by Truncator have been simplified in order 
to
   avoid potential backtracking issues. As a consequence, trailing 
punctuation
   may now at times be included in the truncated output.
 .
 - CVE-2019-14233: Prevent a possible denial-of-service in strip_tags().
 .
   Due to the behavior of the underlying HTMLParser,
   django.utils.html.strip_tags() would be extremely slow to evaluate
   certain inputs containing large sequences of nested incomplete HTML
   entities. The strip_tags() method is used to implement the corresponding
   striptags template filter, which was thus also vulnerable.
 .
   strip_tags() now avoids recursive calls to HTMLParser when progress
   removing tags, but necessarily incomplete HTML entities, stops being 
made.
 .
   Remember that absolutely NO guarantee is provided about the results of
   strip_tags() being HTML safe. So NEVER mark safe the result of a
   strip_tags() call without escaping it first, for example with
   django.utils.html.escape().
 .
   * Correct a previous changelog entry to refer to CVE-2019-12781, not
 CVE-2019-12308.
Checksums-Sha1:
 db39727864864bc8237e2ffcd75efb4cec4bfb18 2721 python-django_1.7.11-1+deb8u7.dsc
 f9abaf7eacec73bc1c5e6080e2778a7174ebf9d4 7586798 
python-django_1.7.11.orig.tar.gz
 ca70dd4717c1bbf9f70f1a4ac080981f63a36bde 39460 
python-django_1.7.11-1+deb8u7.debian.tar.xz
 bfb2f2214ab06c475ad88d57bd3b06c44499fd6c 992498 
python-django_1.7.11-1+deb8u7_all.deb
 661b97d163220b3b8e50ab5f280e91c57c45e4d3 975642 
python3-django_1.7.11-1+deb8u7_all.deb
 00c52c8d9a4675d472b2394fb120ff834d22139e 1499308 
python-django-common_1.7.11-1+deb8u7_all.deb
 bfd33d5510dd02ae0ff42d2377ea2d752ea8a932 2486888 
python-django-doc_1.7.11-1+deb8u7_all.deb
Checksums-Sha256:
 df0416d21d204ec0fad7abf0ed8552e10b2834c97b0132984a8bc6de594f4973 2721 
python-django_1.7.11-1+deb8u7.dsc
 2039144fce8f1b603d03fa5a5643578df1ad007c4ed41a617f02a3943f7059a1 7586798 
python-django_1.7.11.orig.tar.gz
 ce02315bb8577a1b075af54f83da3330a76b5997d9d89710d48ca27c215fcdcb 39460 
python-django_1.7.11-1+deb8u7.debian.tar.xz
 fac4403c64cbd796c4867ab106ff60a782337896541242039872057589373196 992498 
python-django_1.7.11-1+deb8u7_all.deb
 24c2a93c743e7e0843b062df15cdb4e58c61073dba6df52b05dcf31877cd4722 975642 
python3-django_1.7.11-1+deb8u7_all.deb
 80b9ff8920a676765d1aed996795cad24191f4be08d353efc1155b19106b965c 1499308 
python-django-common_1.7.11-1+deb8u7_all.deb
 a907686e253f1652a8956c6dd5c0460a8757770dca0054f1d8b78cfab4f7d2cf 2486888 
python-django-doc_1.7.11-1+deb8u7_all.deb
Files:
 a3cdcd8949027bbcbf8fbed35d3415cd 2721 python optional 
python-django_1.7.11-1+deb8u7.dsc
 030b2f9c99a6e4e0418eadf7dba9e235 7586798 python optional 
python-django_1.7.11.orig.tar.gz
 0868f9949d46a5b11208c6b865b457eb 39460 python optional 
python-django_1.7.11-1+deb8u7.debian.tar.xz
 e2fab59bdd4badf4a77e51fe91f6305d 992498 python optional 
python-django_1.7.11-1+deb8u7_all.deb
 8da5a88692f6c7d838face6bc2ae66c0 975642 python optional 
python3-django_1.7.11-1+deb8u7_all.deb
 23a675259cf8499bbbead48a355098a0 1499308 python optional 
python-django-common_1.7.11-1+deb8u7_all.deb
 cb3946720cd7e0097d596c28cf4dcada 2486888 doc optional 
python-django-doc_1.7.11-1+deb8u7_all.deb

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAl1Jf2QACgkQHpU+J9Qx
Hli1bA/+MUDqzIrQJSt7Rj1FCQVAGOyXkHMM5Ap73TOkN1I87m4AjbAEObP3zmyU

[SECURITY] [DLA 1872-1] python-django security update

2019-08-06 Thread Chris Lamb 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Package: python-django
Version: 1.7.11-1+deb8u7
CVE IDs: CVE-2019-14232 CVE-2019-14233
Debian Bug : #934026

It was discovered that there were two vulnerabilities in the
Django web development framework:

  * CVE-2019-14232: Prevent a possible denial-of-service in
django.utils.text.Truncator.

If django.utils.text.Truncator's chars() and words() methods were
passed the html=True argument, they were extremely slow to
evaluate certain inputs due to a catastrophic backtracking
vulnerability in a regular expression.  The chars() and words()
methods are used to implement the truncatechars_html and
truncatewords_html template filters, which were thus vulnerable.

The regular expressions used by Truncator have been simplified in
order to avoid potential backtracking issues. As a consequence,
trailing punctuation may now at times be included in the
truncated output.

  * CVE-2019-14233: Prevent a possible denial-of-service in strip_tags().

Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to
evaluate certain inputs containing large sequences of nested
incomplete HTML entities. The strip_tags() method is used to
implement the corresponding striptags template filter, which was
thus also vulnerable.

strip_tags() now avoids recursive calls to HTMLParser when
progress removing tags, but necessarily incomplete HTML entities,
stops being made.

Remember that absolutely NO guarantee is provided about the
results of strip_tags() being HTML safe. So NEVER mark safe the
result of a strip_tags() call without escaping it first, for
example with django.utils.html.escape().

For Debian 8 "Jessie", these has been fixed in python-django version
1.7.11-1+deb8u7.

We recommend that you upgrade your python-django packages. You can
find more information in upstream's announcement:

  https://www.djangoproject.com/weblog/2019/aug/01/security-releases/

Thanks to Carlton Gibson et al. for their handling of these issues.


Regards,

- -- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAl1JTwwACgkQHpU+J9Qx
HlhaaBAArc9i9Mi9GP3FMdogAsB7l/BoDTFYeZKp++xfTxey/EF6k0tm9yuxIG7e
mtzpcZfFnXmRm3OG98WNRZsIUm3D/Lq4bAZYCjoMOkfuC3aAlP9xDupBPD2UI5lz
OTurCJqMiL3ucgn/UwWikflpIzGP97GRqeKW01bNEx5G3v5yV6fmDg3QYt7a/dUd
z6SLdxBkjqpjP2ylY04eRa8Fa1McGgqtsC3u1Rfz47OyRlB3oJgOYgBf2XwqqC7A
leT1PdSdLQHwFmEHt2EuT0kEdKjiV2Ef4E6T3n+bAgEXx5blPhb0+AWycAbN9j8B
n1VJoGPnXRxzFIMvKUQ8VBfQDJL1sFoTVsQ5a4Goy99C2Sdz6hv0Wlmi1Mx+Nzjb
YtgRWYF9NbCbzziZZ5y+87BPKDPuIw43oeULeng/SfnQavsBMlZn0WG0+diArU/i
+KAE8xBKuRKeUVMdIe2ryP2uuTDL6RxFeW/qkaEgbEvgSXXTzBPaUU3oi7iLE+w9
2exrLP5o0LZXeJHoceaexuS9iuC6XoEgleFiQfo1d4DpQjb19yrPWU9kfesyxPVw
PWyU17gplkKhJv+zzUjH483BhmQI6nl+Jo1AaEeIelvZ8Js3ncvvPFjnmUQhweGt
ruTk8537/dpT57uEEtg7XmCe+L82GJg+U6pxpx0ggZO0GziIEMk=
=ZinI
-END PGP SIGNATURE-