Pardus alert 2011-70 (python)

From:
    	       Meltem Parmaksız <meltem@pardus.org.tr> 
To:
    	       pardus-security@pardus.org.tr 
Subject:
    	       [Pardus-security] [PLSA 2011-70] python: Improper management of
	ftp:// and file:// URL schemes 
Date:
    	       Tue, 3 May 2011 14:11:10 +0300
Message-ID:
    	       <201105031411.10263.meltem@pardus.org.tr>
Archive-link:
    	       Article, Thread

------------------------------------------------------------------------
Pardus Linux Security Advisory 2011-70            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2011-05-02
      Type: Remote
------------------------------------------------------------------------

Summary
=======

A vulnerability have been fixed in pyhton which which allows  attackers 
to cause a denial of service or to access sensitive information 

Description
===========

CVE-2011-1521: 

A security flaw was found in the way handlers for ftp:// and file:// URL
schemes in the Python urllib and urllib2 extensible llibraries processed
the urllib open URL request. A remote attacker could use this  flaw  to 
access sensitive information or cause a denial of service (excessive CPU
and memory use) of a Python web application,  processing  URLs,  via  a 
specially- crafted urllib open URL request. 

Affected packages:

  Pardus 2009:
    python, all before 2.6.5-61-21

Resolution
==========

There are update(s) for python. You can update them via Package Manager 
or with a single command from console: 

    pisi up python

References
==========

  * http://bugs.pardus.org.tr/show_bug.cgi?id=17578

------------------------------------------------------------------------
_______________________________________________
Pardus-Security mailing list
Pardus-Security@pardus.org.tr
http://liste.pardus.org.tr/mailman/listinfo/pardus-security