Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from http://mail.python.org/pipermail/python-dev/2008-November/083630.html below:

[Python-Dev] CVE tracking

• Previous message: [Python-Dev] CVE tracking
• Next message: [Python-Dev] issue 4336
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Perl had a few CVE because of its rmtree implementation.  Removing  
trees is risky business if root runs the function while other users  
have access to manipulate the tree.  Python's shutils.rmtree seems to  
have many of the same issues.
For instance http://bugs.debian.org/286922 shows how to get root to  
remove /etc/passwd.  The attack should work with shutils.rmtree as  
well.  The referenced bug is a followup to CVE-2005-0448.
This just to show that there are relevant CVEs that don't have the  
keyword "python" attached to them.
--Gisle

• Previous message: [Python-Dev] CVE tracking
• Next message: [Python-Dev] issue 4336
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4