Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2012-05-02 Thread Adam D. Barratt
On Tue, 2011-12-20 at 20:18 +, Adam D. Barratt wrote: On Tue, 2011-12-20 at 09:44 +0100, Piotr Ożarowski wrote: [Adam D. Barratt, 2011-12-19] [...] Looking at the diff, and the equivalent code in the unstable package, there seems to be a missing component - namely, that the directory

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2012-01-12 Thread Adam D. Barratt
On Tue, 2011-12-20 at 20:18 +, Adam D. Barratt wrote: On Tue, 2011-12-20 at 09:44 +0100, Piotr Ożarowski wrote: [Adam D. Barratt, 2011-12-19] Looking at the diff, and the equivalent code in the unstable package, there seems to be a missing component - namely, that the directory

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Piotr Ożarowski
[Adam D. Barratt, 2011-12-19] I noticed that an upload which appears to fix this issue (although without reference the bug number) has appeared in p-u-NEW. Whilst sorry, I didn't notice a bug was reported that's an admirable turn-around :-) it really should have been discussed with the SRMs

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Adam D. Barratt
On Tue, 2011-12-20 at 09:44 +0100, Piotr Ożarowski wrote: [Adam D. Barratt, 2011-12-19] I noticed that an upload which appears to fix this issue (although without reference the bug number) has appeared in p-u-NEW. Whilst sorry, I didn't notice a bug was reported No worries. I assumed

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Nico Golde
Hi, * Adam D. Barratt a...@adam-barratt.org.uk [2011-12-20 21:22]: On Tue, 2011-12-20 at 09:44 +0100, Piotr O??arowski wrote: [...] that's an admirable turn-around :-) it really should have been discussed with the SRMs first, rather than simply uploading (I believe this is well

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-20 Thread Adam D. Barratt
On Tue, 2011-12-20 at 21:24 +0100, Nico Golde wrote: Hi, * Adam D. Barratt a...@adam-barratt.org.uk [2011-12-20 21:22]: If the thread involved the security team saying please fix this via proposed-updates, there's an implied by talking to the release team attached. We're generally not

Re: Bug#652653: python-virtualenv: insecure /tmp file handling

2011-12-19 Thread Adam D. Barratt
Hi, On Mon, 2011-12-19 at 17:19 +0100, Nico Golde wrote: it was discovered that python-virtualenv is handling /tmp files in an insecure manner. The following patch fixed this problem: https://bitbucket.org/ianb/virtualenv/changeset/8be37c509fe5 I noticed that an upload which appears to fix