Merge lp:~jtaylor/ubuntu/natty/python-django-piston/fix-884910 into lp:ubuntu/natty/python-django-piston

[Julian Taylor]

security update, see linked bug

[Jamie Strandboge (jdstrand)]

This was applied weeks ago.

review: Approve

Unmerged revisions

4. By Julian Taylor on 2011-11-02

* SECURITY UPDATE: remote code execution vulnerability. LP: #884910
   - 02-fix-yaml-load.diff: use yaml.safe_load,
   - 03-fix-pickle-load.diff: disable unpickling, backport from 0.2.3
   - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/

=== modified file 'debian/changelog'
--- debian/changelog	2011-01-09 03:49:03 +0000
+++ debian/changelog	2011-11-02 18:30:31 +0000
@@ -1,3 +1,12 @@
+python-django-piston (0.2.2-1ubuntu1.11.04.1) natty-security; urgency=low
+
+  * SECURITY UPDATE: remote code execution vulnerability. LP: #884910
+     - 02-fix-yaml-load.diff: use yaml.safe_load, 
+     - 03-fix-pickle-load.diff: disable unpickling, backport from 0.2.3
+     - https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/
+
+ -- Julian Taylor <[e-mail]>  Wed, 02 Nov 2011 19:18:12 +0100
+
 python-django-piston (0.2.2-1ubuntu1) natty; urgency=low
 
   [ Leo Jackson ]

=== added file 'debian/patches/02-fix-yaml-load.diff'
--- debian/patches/02-fix-yaml-load.diff	1970-01-01 00:00:00 +0000
+++ debian/patches/02-fix-yaml-load.diff	2011-11-02 18:30:31 +0000
@@ -0,0 +1,18 @@
+Description: Fix a security bug in the YAML emitter.
+ See https://bitbucket.org/jespern/django-piston/changeset/91bdaec89543
+Forwarded: not-needed
+Author: Michael Ziegler <[e-mail]>
+
+Index: python-django-piston-0.2.2/piston/emitters.py
+===================================================================
+--- python-django-piston-0.2.2.orig/piston/emitters.py	2009-06-14 12:04:30.000000000 +0200
++++ python-django-piston-0.2.2/piston/emitters.py	2011-11-01 19:19:34.526595345 +0100
+@@ -385,7 +385,7 @@
+ 
+ if yaml:  # Only register yaml if it was import successfully.
+     Emitter.register('yaml', YAMLEmitter, 'application/x-yaml; charset=utf-8')
+-    Mimer.register(yaml.load, ('application/x-yaml',))
++    Mimer.register(yaml.safe_load, ('application/x-yaml',))
+ 
+ class PickleEmitter(Emitter):
+     """

=== added file 'debian/patches/03-fix-pickle-load.diff'
--- debian/patches/03-fix-pickle-load.diff	1970-01-01 00:00:00 +0000
+++ debian/patches/03-fix-pickle-load.diff	2011-11-02 18:30:31 +0000
@@ -0,0 +1,28 @@
+Description: Fix a security bug in the pickle loader.
+ See Bug Report #646517
+Forwarded: not-needed
+Author: Michael Ziegler <[e-mail]>
+
+Index: python-django-piston-0.2.2/piston/emitters.py
+===================================================================
+--- python-django-piston-0.2.2.orig/piston/emitters.py	2011-11-02 18:16:16.685560613 +0100
++++ python-django-piston-0.2.2/piston/emitters.py	2011-11-02 18:17:07.451559769 +0100
+@@ -395,7 +395,17 @@
+         return pickle.dumps(self.construct())
+         
+ Emitter.register('pickle', PickleEmitter, 'application/python-pickle')
+-Mimer.register(pickle.loads, ('application/python-pickle',))
++
++"""
++WARNING: Accepting arbitrary pickled data is a huge security concern.
++The unpickler has been disabled by default now, and if you want to use
++it, please be aware of what implications it will have.
++
++Read more: http://nadiana.com/python-pickle-insecure
++
++Uncomment the line below to enable it. You're doing so at your own risk.
++"""
++#Mimer.register(pickle.loads, ('application/python-pickle',))
+ 
+ class DjangoEmitter(Emitter):
+     """

=== modified file 'debian/patches/series'
--- debian/patches/series	2010-02-22 08:43:21 +0000
+++ debian/patches/series	2011-11-02 18:30:31 +0000
@@ -1,1 +1,3 @@
 01-fix-oauth-import.diff
+03-fix-pickle-load.diff
+02-fix-yaml-load.diff