Subject: bug#32877: closed (Re: bug#32877: Python-2 CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 CVE-2018-1000802)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 17 Oct 2018 18:36:02 +0000

Your bug report

#32877: Python-2 CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 CVE-2018-1000802

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
32877: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=32877
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#32877: Python-2 CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 CVE-2018-1000802
From: Marius Bakke <[email-masked]>
To: Mark H Weaver <[email-masked]>, Leo Famulari <[email-masked]>
Cc: [email-masked]
Date: Wed, 17 Oct 2018 20:35:49 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Mark H Weaver <[email-masked]> writes:

> Leo Famulari <[email-masked]> writes:
>
>> On Sat, Oct 06, 2018 at 06:53:36PM +0200, Marius Bakke wrote:
>>> From 2891a9acb7704c3397ef34fbb520b46936504422 Mon Sep 17 00:00:00 2001
>>> From: Marius Bakke <[email-masked]>
>>> Date: Sat, 6 Oct 2018 18:50:47 +0200
>>> Subject: [PATCH] gnu: python2: Add upstream security fixes.
>>> 
>>> This addresses CVE-2018-{1060,1061,14647,1000802}.
>>> 
>>> * gnu/packages/patches/python2-CVE-2018-1000802.patch,
>>> gnu/packages/patches/python2-CVE-2018-1060.patch,
>>> gnu/packages/patches/python2-CVE-2018-1061.patch,
>>> gnu/packages/patches/python2-CVE-2018-14647.patch: New files.
>>> * gnu/local.mk (dist_patch_DATA): Register it.
>>> * gnu/packages/python.scm (python-2/fixed): New variable.
>>> (python-2.7)[replacement]: New field.
>>> (python2-minimal): Use PACKAGE/INHERIT.
>>
>> Thanks! I did some basic tests and things seem to work.
>
> I added this commit to my private branch a few days ago, along with the
> Python-3 CVE-2018-14647 fix (with the added hunk), updated my GuixSD
> GNOME 3 system and user profile, and everything seems to be working
> well.
>
> I think they are both ready to push to master.

Hi Mark,

Thank you very much for testing.  I've pushed these patches now, sorry
for the delay!

Subject: Python-2 CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 CVE-2018-1000802
From: Leo Famulari <[email-masked]>
To: [email-masked]
Date: Sat, 29 Sep 2018 15:18:27 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Here are some bugs that apply to our Python 2.7.14 package.

CVE-2018-1060 (fixed upstream in Python 2.7.15):
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060

CVE-2018-1061 (fixed upstream in Python 2.7.15):
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061

CVE-2018-14647 (fixed in unreleased CPython commit
18b20bad75b4ff0486940fba4ec680e96e70f3a2):
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647

CVE-2018-1000802 (fixed in unreleased CPython commit
d8b103b8b3ef9644805341216963a64098642435):
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000802