RHBA-2013:0437 - Bug Fix Advisory

Topic

Updated python packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

Python is an interpreted, interactive, object-oriented programming language
often compared to Tcl, Perl, Scheme, or Java. Python includes modules, classes,
exceptions, very high level dynamic data types and dynamic typing. Python
supports interfaces to many system calls and libraries, as well as to various
windowing systems (X11, Motif, Tk, Mac and MFC).

This update fixes the following bugs:

• Previously, applying the python-2.6.5-ctypes-noexecmem patch caused the

ctypes.CFUNCTYPE() function to allocate memory in order to avoid running the
process in a SELinux domain with the execmem permission. When this allocation
process forked without using the exec() function (for example in a
multi-processing module), the state of the allocator was shared between parent
and child processes. This shared state caused unpredictable interactions between
the processes, potentially leading to segmentation faults or lack of termination
of a multiprocessing workload. With this update, python-2.6.5-ctypes-noexecmem
has been reverted, and the unpredictable behavior no longer occurs. In addition,
Python programs are now required to run within a SELinux domain with execmem
permissions. (BZ#707944)

• Prior to this update, any usage of the ctypes module (such as via the "uuid"

module used by the Django application framework) triggered the
ctypes.CFUNCTYPE() function on module import. Consequently, if the process was
missing SELinux permissions, AVC denial messages were returned. This bug has
been fixed, and SELinux permissions are now required only in relevant cases of
ctypes usage, such as passing a Python callable to a C callback. (BZ#814391)

• In certain cases, enabled C-level assertions caused the python library to fail

when building valid Python code. Consequently, code containing four or more
nested "IF" statements within a list comprehension or generator expression
failed to compile. Moreover, an error occurred when formatting certain numpy
objects. With this update, the C-level assertions have been deactivated and the
aforementioned problems no longer occur. (BZ#810847, BZ#841748)

• As part of the fix for CVE-2012-0876, a new symbol ("XML_SetHashSalt") was

added to the system libexpat library, which Python standard library uses in the
pyexpat module. If an unpatched libexpat.so.1 was present in a directory listed
in LD_LIBRARY_PATH, then attempts to use the pyexpat module (for example from
yum) would fail with an ImportError exception. This update adds an RPATH
directive to pyexpat to ensure that libexpat is used by pyexpat, regardless of
whether there is an unpatched libexpat within the LD_LIBRARY_PATH, thus
preventing the ImportError exception. (BZ#833271)

• Due to a bug in the Python logging module, the SysLogHandler class continued

to send log message against a closed connection. Consequently, an infinite loop
occurred when SysLogHandler was used together with the Eventlet library. The bug
has been fixed, and the described issue no longer occurs. (BZ#835460)

All users of python are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 707944 - Bad interaction between python-2.6.5-ctypes-noexecmem.patch, and ctypes.CFUNCTYPE when forking without exec (e.g. "multiprocessing" module)
• BZ - 810847 - Python problem with nested IFs
• BZ - 814391 - UUID package cause SELinux AVC Denials
• BZ - 835460 - An infinite loop happens when we use SysLogHandler with eventlet

CVEs

(none)

References

(none)