Merge lp:~jtaylor/ubuntu/maverick/python-django-piston/fix-884910 into lp:ubuntu/maverick/python-django-piston

[Julian Taylor]

security update, see linked bug

[Jamie Strandboge (jdstrand)]

review: Approve

Unmerged revisions

4. By Julian Taylor on 2011-11-02

* SECURITY UPDATE: remote code execution vulnerability. LP: #884910
   - 02-fix-yaml-load.diff: use yaml.safe_load,
   - 03-fix-pickle-load.diff: disable unpickling, backport from 0.2.3
   - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/

3. By Joker Wild on 2011-01-10

debian/control: Bump Depends on python-oauth 1.0 since we don't
have 1.0.1 yet. Fixes install problem. (LP: #653480)

=== modified file 'debian/changelog'
--- debian/changelog	2010-02-22 08:43:21 +0000
+++ debian/changelog	2011-11-02 18:35:29 +0000
@@ -1,3 +1,19 @@
+python-django-piston (0.2.2-1ubuntu0.2) maverick-security; urgency=low
+
+  * SECURITY UPDATE: remote code execution vulnerability. LP: #884910
+     - 02-fix-yaml-load.diff: use yaml.safe_load, 
+     - 03-fix-pickle-load.diff: disable unpickling, backport from 0.2.3
+     - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
+
+ -- Julian Taylor <[e-mail]>  Wed, 02 Nov 2011 19:18:12 +0100
+
+python-django-piston (0.2.2-1ubuntu0.1) maverick-proposed; urgency=low
+
+  * debian/control: Bump Depends on python-oauth 1.0 since we don't
+    have 1.0.1 yet. Fixes install problem. (LP: #653480) 
+
+ -- Leo Albert Jackson Jr (Coders United) <[e-mail]>  Mon, 10 Jan 2011 00:16:35 +0100
+
 python-django-piston (0.2.2-1) unstable; urgency=low
 
   * Initial release (Closes: #570919)

=== modified file 'debian/control'
--- debian/control	2010-02-22 08:43:21 +0000
+++ debian/control	2011-11-02 18:35:29 +0000
@@ -1,7 +1,8 @@
 Source: python-django-piston
 Section: python
 Priority: optional
-Maintainer: Debian Python Modules Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Python Modules Team <[e-mail]>
 Uploaders: Michael Ziegler <[e-mail]>
 Build-Depends: python (>= 2.4), debhelper (>= 7.0.50~), python-setuptools (>= 0.6.10)
 Build-Depends-Indep: python-support
@@ -14,7 +15,7 @@
 Package: python-django-piston
 Architecture: all
 Depends: ${misc:Depends}, ${python:Depends}, python-django (>= 1.1),
- python-oauth (>= 1.0.1), python-decorator
+ python-oauth (>= 1.0), python-decorator
 Suggests: python-yaml
 Description: Django mini-framework creating RESTful APIs
  Piston is a relatively small Django application that lets you

=== added file 'debian/patches/02-fix-yaml-load.diff'
--- debian/patches/02-fix-yaml-load.diff	1970-01-01 00:00:00 +0000
+++ debian/patches/02-fix-yaml-load.diff	2011-11-02 18:35:29 +0000
@@ -0,0 +1,18 @@
+Description: Fix a security bug in the YAML emitter.
+ See https://bitbucket.org/jespern/django-piston/changeset/91bdaec89543
+Forwarded: not-needed
+Author: Michael Ziegler <[e-mail]>
+
+Index: python-django-piston-0.2.2/piston/emitters.py
+===================================================================
+--- python-django-piston-0.2.2.orig/piston/emitters.py	2009-06-14 12:04:30.000000000 +0200
++++ python-django-piston-0.2.2/piston/emitters.py	2011-11-01 19:19:34.526595345 +0100
+@@ -385,7 +385,7 @@
+ 
+ if yaml:  # Only register yaml if it was import successfully.
+     Emitter.register('yaml', YAMLEmitter, 'application/x-yaml; charset=utf-8')
+-    Mimer.register(yaml.load, ('application/x-yaml',))
++    Mimer.register(yaml.safe_load, ('application/x-yaml',))
+ 
+ class PickleEmitter(Emitter):
+     """

=== added file 'debian/patches/03-fix-pickle-load.diff'
--- debian/patches/03-fix-pickle-load.diff	1970-01-01 00:00:00 +0000
+++ debian/patches/03-fix-pickle-load.diff	2011-11-02 18:35:29 +0000
@@ -0,0 +1,28 @@
+Description: Fix a security bug in the pickle loader.
+ See Bug Report #646517
+Forwarded: not-needed
+Author: Michael Ziegler <[e-mail]>
+
+Index: python-django-piston-0.2.2/piston/emitters.py
+===================================================================
+--- python-django-piston-0.2.2.orig/piston/emitters.py	2011-11-02 18:16:16.685560613 +0100
++++ python-django-piston-0.2.2/piston/emitters.py	2011-11-02 18:17:07.451559769 +0100
+@@ -395,7 +395,17 @@
+         return pickle.dumps(self.construct())
+         
+ Emitter.register('pickle', PickleEmitter, 'application/python-pickle')
+-Mimer.register(pickle.loads, ('application/python-pickle',))
++
++"""
++WARNING: Accepting arbitrary pickled data is a huge security concern.
++The unpickler has been disabled by default now, and if you want to use
++it, please be aware of what implications it will have.
++
++Read more: http://nadiana.com/python-pickle-insecure
++
++Uncomment the line below to enable it. You're doing so at your own risk.
++"""
++#Mimer.register(pickle.loads, ('application/python-pickle',))
+ 
+ class DjangoEmitter(Emitter):
+     """

=== modified file 'debian/patches/series'
--- debian/patches/series	2010-02-22 08:43:21 +0000
+++ debian/patches/series	2011-11-02 18:35:29 +0000
@@ -1,1 +1,3 @@
 01-fix-oauth-import.diff
+03-fix-pickle-load.diff
+02-fix-yaml-load.diff