Re: CVE Request: Insecure Software Download in pip

[Donald Stufft <donald () stufft io>]

On Jul 27, 2013, at 3:08 AM, Kurt Seifried <kseifried () redhat com> wrote:

> On 07/25/2013 03:09 AM, Donald Stufft wrote:
> > I'd like to request a CVE for pip
> > (https://pypi.python.org/pypi/pip/).
> >
> > The mirroring support (-M, --use-mirrors) was implemented without
> > any sort of authenticity checks and is downloaded over plaintext
> > HTTP. Further more by default it will dynamically discover the list
> > of available mirrors by querying a DNS entry and extrapolating from
> > that data. It does not attempt to use any sort of method of
> > securing this querying of the DNS like DNSSEC. Software packages
> > are downloaded over these insecure links, unpacked, and then
> > typically the setup.py python file inside of them is executed.
> >
> > The vulnerable code is located at: -
> > https://github.com/pypa/pip/blob/develop/pip/index.py#L60-L64 -
> > https://github.com/pypa/pip/blob/develop/pip/index.py#L205-L207 -
> > https://github.com/pypa/pip/blob/develop/pip/index.py#L553-L572 -
> > https://github.com/pypa/pip/blob/develop/pip/index.py#L999-L1024
> >
> > The affected versions are every released version since 0.8.1 which
> > are: 0.8.1, 0.8.2, 0.8.3, 1.0, 1.0.1, 1.0.2, 1.1, 1.2, 1.2.1, 1.3,
> > 1.3.1, 1.4
> >
> > I'm not aware of this issue having ever had a CVE requested for it
> > and my attempts to search the CVE database did not appear to turn
> > up anything relevant but the search doesn't appear to be the
> > greatest so I may have missed it.
> >
> > I'm hoping to land a patch for this in a future release (current
> > iteration of patch available at
> > https://github.com/dstufft/pip/compare/remove-mirror-support) but
> > there is no planned fix version as of yet.
> >
> > ----------------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B
> > 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
>
> Was it supposed to be secure (like was this explicitly supposed to be
> all encrypted/etc.)? This sounds more like security hardening than a
> security vulnerability.
>
> - -- 
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

The mirroring protocol explicitly included provisions for verification which
was not being done.

http://www.python.org/dev/peps/pep-0381/#mirror-authenticity

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail