Merge lp:~jtaylor/ubuntu/precise/python-tornado/CVE-2012-2374 into lp:ubuntu/precise/python-tornado

[Julian Taylor]

[Jamie Strandboge (jdstrand)]

Steve Beattie approved this already and the issue is fixed.

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2012-03-13 18:08:33 +0000
+++ debian/changelog	2012-05-22 17:30:27 +0000
@@ -1,3 +1,12 @@
+python-tornado (2.1.0-2ubuntu0.1) precise-security; urgency=low
+
+  * SECURITY UPDATE: http header injection (LP: #1003019)
+  - debian/patches/CVE-2012-2374.patch: fix header sanitation
+    thanks to Ben Darnell
+  - CVE-2012-2374
+
+ -- Julian Taylor <[e-mail]>  Tue, 22 May 2012 19:14:51 +0200
+
 python-tornado (2.1.0-2) unstable; urgency=low
 
   [ Thomas Kluyver ]

=== modified file 'debian/control'
--- debian/control	2012-03-13 18:08:33 +0000
+++ debian/control	2012-05-22 17:30:27 +0000
@@ -3,7 +3,8 @@
 X-Python-Version: >= 2.5
 X-Python3-Version: >= 3.2
 Priority: optional
-Maintainer: Debian Python Modules Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Python Modules Team <[e-mail]>
 Uploaders: Carl Chenet <[e-mail]>,
            Yaroslav Halchenko <[e-mail]>
 Build-Depends: debhelper (>= 7.0.50~),

=== added file 'debian/patches/CVE-2012-2374.patch'
--- debian/patches/CVE-2012-2374.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/CVE-2012-2374.patch	2012-05-22 17:30:27 +0000
@@ -0,0 +1,15 @@
+Description: fix CVE-2012-2374
+Applied-Upstream: 2.2.1
+Origin: https://github.com/facebook/tornado/commit/1ae91f6d58e6257e0ab49d295d8741ce1727bdb7
+Author: Julian Taylor <[e-mail]>
+--- a/tornado/web.py
++++ b/tornado/web.py
+@@ -258,7 +258,7 @@
+         # If \n is allowed into the header, it is possible to inject
+         # additional headers or split the request. Also cap length to
+         # prevent obviously erroneous values.
+-        if len(value) > 4000 or re.match(b(r"[\x00-\x1f]"), value):
++        if len(value) > 4000 or re.search(b(r"[\x00-\x1f]"), value):
+             raise ValueError("Unsafe header value %r", value)
+         return value
+ 

=== modified file 'debian/patches/series'
--- debian/patches/series	2011-03-01 02:38:06 +0000
+++ debian/patches/series	2012-05-22 17:30:27 +0000
@@ -1,2 +1,3 @@
 ignore-ca-certificates.patch
 certs-path.patch
+CVE-2012-2374.patch