Bug 201515 - devel/ipython: CSRF possible remote execution vulnerability
Summary: devel/ipython: CSRF possible remote execution vulnerability
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Jimmy Olgeni
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-13 02:34 UTC by Jason Unovitch
Modified: 2015-07-22 23:50 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (olgeni)

Attachments
security/vuxml for iPython 3.2.1 (2.01 KB, patch)
2015-07-13 02:36 UTC, Jason Unovitch 		no flags Details | Diff
py27-ipython-3.2.1.diff (760 bytes, patch)
2015-07-13 02:40 UTC, Jason Unovitch 		no flags Details | Diff
security/vuxml update with CVE-2015-5607 assignment (593 bytes, patch)
2015-07-22 01:07 UTC, Jason Unovitch 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Jason Unovitch freebsd_committer freebsd_triage 2015-07-13 02:36:57 UTC 
Created attachment 158677 [details]
security/vuxml for iPython 3.2.1

% make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml
>>> Successful.
Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit ipython-3.2.0
ipython-3.2.0 is vulnerable:
devel/ipython -- CSRF possible remote execution vulnerability
WWW: https://vuxml.FreeBSD.org/freebsd/81326883-2905-11e5-a4a5-002590263bf5.html

1 problem(s) in the installed packages found.

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit ipython-3.2.1
0 problem(s) in the installed packages found.
Comment 2 Jason Unovitch freebsd_committer freebsd_triage 2015-07-13 02:40:15 UTC 
Created attachment 158678 [details]
py27-ipython-3.2.1.diff

devel/ipython patch for update to 3.2.1

Note Poudriere builds on 8.4 to 11 are running right now.  It looks like it will take overnight.  I will update with Poudriere in the morning.
Comment 3 commit-hook freebsd_committer freebsd_triage 2015-07-13 08:39:59 UTC 
A commit references this bug:

Author: olgeni
Date: Mon Jul 13 08:39:09 UTC 2015
New revision: 391882
URL: https://svnweb.freebsd.org/changeset/ports/391882

Log:
  Document CSRF remote execution vulnerability for devel/ipython (CVE pending).

  PR:		201515
  Submitted by:	Jason Unovitch

Changes:
  head/security/vuxml/vuln.xml
Comment 4 commit-hook freebsd_committer freebsd_triage 2015-07-13 08:43:00 UTC 
A commit references this bug:

Author: olgeni
Date: Mon Jul 13 08:42:40 UTC 2015
New revision: 391883
URL: https://svnweb.freebsd.org/changeset/ports/391883

Log:
  Update to version 3.2.1.

  PR:		201515
  Submitted by:	Jason Unovitch

Changes:
  head/devel/ipython/Makefile
  head/devel/ipython/distinfo
Comment 5 Jason Unovitch freebsd_committer freebsd_triage 2015-07-14 01:31:40 UTC 
Thanks.

MFH to 2015Q3 and close?
Comment 6 Jimmy Olgeni freebsd_committer freebsd_triage 2015-07-14 08:16:36 UTC 
(In reply to Jason Unovitch from comment #5)

Diff sent for review - does this have a CVE? I see no reply to the linked email so far.
Comment 7 Jason Unovitch freebsd_committer freebsd_triage 2015-07-14 10:43:30 UTC 
(In reply to Jimmy Olgeni from comment #6)
Super. Thanks.

I haven't seen a CVE yet.  I'll keep my eye out on my email and pass the word along when I see it since this one isn't the only one I am waiting for.
Comment 8 Jason Unovitch freebsd_committer freebsd_triage 2015-07-22 01:07:00 UTC 
Created attachment 159056 [details]
security/vuxml update with CVE-2015-5607 assignment

Jimmy,
CVE-2015-5607 was assigned.  The existing http://seclists.org/oss-sec/2015/q3/92 reference already covers it; it is just available later in that thread.  Patch attached to document the assignment.

SVN Log:

- Document CVE assignment in iPython 3.2.1 entry

PR:		201515
Security:	CVE-2015-5607
Security:	81326883-2905-11e5-a4a5-002590263bf5
Comment 9 commit-hook freebsd_committer freebsd_triage 2015-07-22 22:51:45 UTC 
A commit references this bug:

Author: olgeni
Date: Wed Jul 22 22:51:34 UTC 2015
New revision: 392700
URL: https://svnweb.freebsd.org/changeset/ports/392700

Log:
  Document CVE assignment in iPython 3.2.1 entry.

  PR:		201515
  Security:	CVE-2015-5607
  Security:	81326883-2905-11e5-a4a5-002590263bf5

Changes:
  head/security/vuxml/vuln.xml
Comment 10 Jimmy Olgeni freebsd_committer freebsd_triage 2015-07-22 23:50:15 UTC 
3.2.1 merged in r392704. Thanks!