Debian Bug report logs - #605169
gnome-schedule: Use of PYTHONPATH env var in an insecure way

Display info messages

Message #5 received at maintonly@bugs.debian.org (full text, mbox, reply):

From: Sandro Tosi <morph@debian.org>

To: maintonly@bugs.debian.org

Subject: gnome-schedule: Use of PYTHONPATH env var in an insecure way

Date: Sat, 27 Nov 2010 22:38:36 +0000

Package: gnome-schedule
Version: 2.1.1-3
Severity: grave
Tags: security
User: debian-python@lists.debian.org
Usertags: pythonpath

Jakub Wilk performed an analysis[1] for packages setting PYTHONPATH in
an insecure way. Those packages do something like:

    PYTHONPATH=/spam/eggs:$PYTHONPATH

This is wrong, because if PYTHONPATH were originally unset or empty,
current working directory would be added to sys.path.

[1] http://lists.debian.org/debian-python/2010/11/msg00045.html

Your package turns out to have vulnerable scripts in PATH: you can
find a complete log at [2].

[2] http://people.debian.org/~morph/mbf/pythonpath.txt

Some guidelines on how to fix these bugs: in the case given above, you
can use something like

    PYTHONPATH=/spam/eggs${PYTHONPATH:+:$PYTHONPATH}

(If you don't known this construct, grep for "Use Alternative Value"
in the bash/dash manpage.)

Also, in cases like

   PYTHONPATH=/usr/lib/python2.5/site-packages/:$PYTHONPATH

or

   PYTHONPATH=$PYTHONPATH:$SPAMDIR exec python $SPAMDIR/spam.py

you shouldn't need to touch PYTHONPATH at all.

Feel free to contact debian-python@lists.debian.org in case of
help.

Send a report that this bug log contains spam.