4.243. python

BZ#697470

The Python standard library contains numerous APIs that handle the uid_t and gid_t attributes, which contain unsigned 32-bit values. Previously, the existing code often passed the values as C language long values, which are signed 32-bit values on 32-bit architectures. Consequently, negative integer objects occurred when a uid_t/gid_t value was equal or larger than 2^31 on 32-bit architectures. With this update, the standard library has been updated throughout to accept the full range of uid_t/gid_t values (0 through 2^32-1), using "int" objects for small values, but using "long" objects where needed to avoid integer overflow. As a special case, "-1" is also supported, as this value has special meaning for the os.chown() function and other related functions.

BZ#713082

Previously, the multiprocessing module used the "select" system call to communicate with subprocesses, limiting the number of file descriptors to the value of the FD_SETSIZE variable (1024). With this update, the multiprocessing module has been ported to use the "poll" system call, instead of "select", thus fixing this bug.

BZ#685234

Previously, a race condition sometimes caused the forking.Popen.poll() method of the multiprocessing module to terminate with the "OSError: [Errno 10] No child processes" error message when starting subprocesses. This bug has been fixed and the crashes no longer occur in the described scenario.

BZ#689794

Previously, the getpass.getpass() method discarded Ctrl-C and Ctrl-Z input, requiring the user to press Ctrl-D to exit the password entry prompt and then returning traceback error messages. With this update, the described user input is processed properly by the getpass.getpass() method.

BZ#699740

Due to a bug, the readline.get_history_length() and readline.get_history_item() methods leaked memory when executed. This bug has been fixed and no longer occurs.

BZ#727364

When building the C extension modules, if a value for the CFLAGS variable is defined in the environment, it is appended to the compilation flags from Python's Makefile. Due to a bug, only flags stored in the OPT variable were supplied from the Makefile. Consequently, the "-fno-strict-aliasing" flag was missing and build errors occurred. This bug has been fixed, CFLAGS are properly appended to the original Python build string, and no build errors are now returned in the described scenario.

BZ#667431

When feeding data to the standard input of short-lived processes, the subprocess.Popen.communicate() method sometimes terminated with the "OSError: [Errno 32] Broken pipe" error message. This bug has been fixed and the crashes no longer occur in the described scenario.

BZ#711818

The gdb (GNU Debugger) Python hooks for debugging Python itself (via the python-debuginfo package) have been enhanced. The hooks now report if a thread is waiting on a lock, such as the GIL (Global Interpreter Lock), and call to appropriate C functions, methods, and garbage collections. In addition, the hooks have been optimized to provide at least file and function names, when line numbers and locals are not available.

Security Fixes

CVE-2012-1150

A denial of service flaw was found in the implementation of associative arrays (dictionaries) in Python. An attacker able to supply a large number of inputs to a Python application (such as HTTP POST request parameters sent to a web application) that are used as keys when inserting data into an array could trigger multiple hash function collisions, making array operations take an excessive amount of CPU time. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. ()

Note

The hash randomization is not enabled by default as it may break applications that incorrectly depend on dictionary ordering. To enable the protection, the new "PYTHONHASHSEED" environment variable or the Python interpreter's "-R" command line option can be used. Refer to the python(1) manual page for details.

The RHSA-2012:0731 expat erratum must be installed with this update, which adds hash randomization to the Expat library used by the Python pyexpat module.

CVE-2012-0845

A flaw was found in the way the Python SimpleXMLRPCServer module handled clients disconnecting prematurely. A remote attacker could use this flaw to cause excessive CPU consumption on a server using SimpleXMLRPCServer.

CVE-2011-4940

A flaw was found in the way the Python SimpleHTTPServer module generated directory listings. An attacker able to upload a file with a specially-crafted name to a server could possibly perform a cross-site scripting (XSS) attack against victims visiting a listing page generated by SimpleHTTPServer, for a directory containing the crafted file (if the victims were using certain web browsers).

CVE-2011-4944

A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this flaw to gain access to that user's .pypirc file, which can contain usernames and passwords for code repositories.