Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

4.243. python

Updated python packages that fix several bugs and add an enhancement are now available for Red Hat Enterprise Linux 6.
Python is an interpreted, interactive, object-oriented programming language.

Bug Fixes

BZ#697470
The Python standard library contains numerous APIs that handle the uid_t and gid_t attributes, which contain unsigned 32-bit values. Previously, the existing code often passed the values as C language long values, which are signed 32-bit values on 32-bit architectures. Consequently, negative integer objects occurred when a uid_t/gid_t value was equal or larger than 2^31 on 32-bit architectures. With this update, the standard library has been updated throughout to accept the full range of uid_t/gid_t values (0 through 2^32-1), using "int" objects for small values, but using "long" objects where needed to avoid integer overflow. As a special case, "-1" is also supported, as this value has special meaning for the os.chown() function and other related functions.
BZ#713082
Previously, the multiprocessing module used the "select" system call to communicate with subprocesses, limiting the number of file descriptors to the value of the FD_SETSIZE variable (1024). With this update, the multiprocessing module has been ported to use the "poll" system call, instead of "select", thus fixing this bug.
BZ#685234
Previously, a race condition sometimes caused the forking.Popen.poll() method of the multiprocessing module to terminate with the "OSError: [Errno 10] No child processes" error message when starting subprocesses. This bug has been fixed and the crashes no longer occur in the described scenario.
BZ#689794
Previously, the getpass.getpass() method discarded Ctrl-C and Ctrl-Z input, requiring the user to press Ctrl-D to exit the password entry prompt and then returning traceback error messages. With this update, the described user input is processed properly by the getpass.getpass() method.
BZ#699740
Due to a bug, the readline.get_history_length() and readline.get_history_item() methods leaked memory when executed. This bug has been fixed and no longer occurs.
BZ#727364
When building the C extension modules, if a value for the CFLAGS variable is defined in the environment, it is appended to the compilation flags from Python's Makefile. Due to a bug, only flags stored in the OPT variable were supplied from the Makefile. Consequently, the "-fno-strict-aliasing" flag was missing and build errors occurred. This bug has been fixed, CFLAGS are properly appended to the original Python build string, and no build errors are now returned in the described scenario.
BZ#667431
When feeding data to the standard input of short-lived processes, the subprocess.Popen.communicate() method sometimes terminated with the "OSError: [Errno 32] Broken pipe" error message. This bug has been fixed and the crashes no longer occur in the described scenario.

Enhancement

BZ#711818
The gdb (GNU Debugger) Python hooks for debugging Python itself (via the python-debuginfo package) have been enhanced. The hooks now report if a thread is waiting on a lock, such as the GIL (Global Interpreter Lock), and call to appropriate C functions, methods, and garbage collections. In addition, the hooks have been optimized to provide at least file and function names, when line numbers and locals are not available.
All users of python are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.
Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below.
Python is an interpreted, interactive, object-oriented programming language.

Security Fixes

CVE-2012-1150
A denial of service flaw was found in the implementation of associative arrays (dictionaries) in Python. An attacker able to supply a large number of inputs to a Python application (such as HTTP POST request parameters sent to a web application) that are used as keys when inserting data into an array could trigger multiple hash function collisions, making array operations take an excessive amount of CPU time. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. ()

Note

The hash randomization is not enabled by default as it may break applications that incorrectly depend on dictionary ordering. To enable the protection, the new "PYTHONHASHSEED" environment variable or the Python interpreter's "-R" command line option can be used. Refer to the python(1) manual page for details.
The RHSA-2012:0731 expat erratum must be installed with this update, which adds hash randomization to the Expat library used by the Python pyexpat module.
CVE-2012-0845
A flaw was found in the way the Python SimpleXMLRPCServer module handled clients disconnecting prematurely. A remote attacker could use this flaw to cause excessive CPU consumption on a server using SimpleXMLRPCServer.
CVE-2011-4940
A flaw was found in the way the Python SimpleHTTPServer module generated directory listings. An attacker able to upload a file with a specially-crafted name to a server could possibly perform a cross-site scripting (XSS) attack against victims visiting a listing page generated by SimpleHTTPServer, for a directory containing the crafted file (if the victims were using certain web browsers).
CVE-2011-4944
A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this flaw to gain access to that user's .pypirc file, which can contain usernames and passwords for code repositories.
Red Hat would like to thank oCERT for reporting CVE-2012-1150. oCERT acknowledges Julian Wälde and Alexander Klink as the original reporters of CVE-2012-1150.
All Python users should upgrade to these updated packages, which contain backported patches to correct these issues.