Skip to content

the script Tools/i18n/msgfmt.py allows arbitrary code execution via po files #57510

@izi

Description

@izi
mannequin
BPO 13301
Nosy @warsaw, @birkenfeld, @benjaminp, @ezio-melotti, @merwok, @akheron, @serhiy-storchaka
Files
  • msgfmt.py.diff: Patch that replaces the eval() call
  • msgfmt.py.diff.update1.diff: Handle unescaped quote at the beginning of the string
  • msgfmt_literal_eval.patch: Use the literal_eval, Luke!
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/ezio-melotti'
    closed_at = <Date 2012-11-09.10:53:39.828>
    created_at = <Date 2011-10-31.09:18:15.563>
    labels = ['type-security']
    title = 'the script Tools/i18n/msgfmt.py allows arbitrary code execution via po files'
    updated_at = <Date 2012-11-09.10:53:39.827>
    user = 'https://bugs.python.org/izi'

    bugs.python.org fields:

    activity = <Date 2012-11-09.10:53:39.827>
    actor = 'ezio.melotti'
    assignee = 'ezio.melotti'
    closed = True
    closed_date = <Date 2012-11-09.10:53:39.828>
    closer = 'ezio.melotti'
    components = ['Demos and Tools']
    creation = <Date 2011-10-31.09:18:15.563>
    creator = 'izi'
    dependencies = []
    files = ['23566', '23567', '27832']
    hgrepos = []
    issue_num = 13301
    keywords = ['patch']
    message_count = 8.0
    messages = ['146678', '146680', '146681', '146683', '173202', '174470', '175219', '175220']
    nosy_count = 9.0
    nosy_names = ['barry', 'georg.brandl', 'benjamin.peterson', 'ezio.melotti', 'eric.araujo', 'python-dev', 'petri.lehtinen', 'izi', 'serhiy.storchaka']
    pr_nums = []
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue13301'
    versions = ['Python 2.7', 'Python 3.2', 'Python 3.3', 'Python 3.4']

    Metadata

    Metadata

    Assignees

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions