← Back to branch summary

~andreserl/+junk/cobbler

« back to all changes in this revision

Viewing changes to debian/patches/58_fix_egg_cache.patch

  • Committer: Andres Rodriguez
  • Date: 2011-12-09 17:39:33 UTC
  • mfrom: (50.1.5 trunk)
  • Revision ID: andreserl@ubuntu.com-20111209173933-6mel1k0noqjd1vad
Tags: 2.1.0+git20110602-0ubuntu26.2
https://launchpad.net/bugs/858860
https://launchpad.net/bugs/858875
https://launchpad.net/bugs/858878
https://launchpad.net/bugs/858883
https://launchpad.net/bugs/863755
* SECURITY UPDATE: arbitrary code execution via PYTHON_EGG_CACHE in insecure
  location (LP: #858875)
  - debian/patches/58_fix_egg_cache.patch: move PYTHON_EGG_CACHE to
    /var/lib/cobbler/webui_cache (copied from fix to precise).
* SECURITY UPDATE: CSRF vulnerability in cobbler-web (LP: #858878)
  - debian/patches/59_add_csrf_protection.patch: use Django's built-in
    CSRF protection (taken from upstream).
* SECURITY UPDATE: arbitrary code execution via web interface (LP: #858883)
  - debian/patches/60_yaml_safe_load.patch: use yaml.safe_load instead of
    yaml.load (taken from upstream).
* SECURITY UPDATE: users.digest file is world readable (LP: #858860)
  - debian/cobbler.postinst: create /etc/cobbler/users.digest as 600
* SECURITY UPDATE: webui_sessions uses insecure permissions (LP: #863755)
  - debian/cobbler.postinst: fix permissions on webui_{sessions,cache} to
    0700

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/58_fix_egg_cache.patch
 
1
Author: Clint Byrum <clint@ubuntu.com>
 
2
Description: Changes PYTHON_EGG_CACHE to a safer path owned just by the webserver.
 
3
Bug: https://fedorahosted.org/cobbler/ticket/688
 
4
Bug-Ubuntu: http://pad.lv/858875
 
5
Forwarded: yes
 
6
 
 
7
Index: cobbler/web/cobbler.wsgi
 
8
===================================================================
 
9
--- cobbler.orig/web/cobbler.wsgi       2011-09-30 16:53:26.522621805 -0700
 
10
+++ cobbler/web/cobbler.wsgi    2011-09-30 17:09:53.909158191 -0700
 
11
@@ -2,7 +2,7 @@
 
12
 import sys
 
13
 
 
14
 os.environ['DJANGO_SETTINGS_MODULE'] = 'settings'
 
15
-os.environ['PYTHON_EGG_CACHE'] = '/tmp'
 
16
+os.environ['PYTHON_EGG_CACHE'] = '/var/lib/cobbler/webui_cache'
 
17
 sys.path.append('/usr/share/cobbler/web')
 
18
 sys.path.append('/usr/share/cobbler/web/cobbler_web')
 
19