mailman/contribs7/mailman-2.1.5.1-CVE-2006-4624.patch

--- mailman-2.1.5.1/Mailman/Utils.py.CVE-2006-4624      2007-05-21 16:23:13.000000000 +0200
+++ mailman-2.1.5.1/Mailman/Utils.py    2007-05-21 16:26:11.000000000 +0200
@@ -50,6 +50,7 @@
 from Mailman import Errors
 from Mailman import Site
 from Mailman.SafeDict import SafeDict
+from Mailman.Logging.Syslog import syslog
 
 try:
     True, False
@@ -216,9 +217,16 @@
 
 
 
+# Patterns which may be used to form malicious path to inject a new
+# line in the mailman error log. (TK: advisory by Moritz Naumann)
+CRNLpat = re.compile(r'[^\x21-\x7e]')
+
 def GetPathPieces(envar='PATH_INFO'):
     path = os.environ.get(envar)
     if path:
+        if CRNLpat.search(path):
+            path = CRNLpat.split(path)[0]
+            syslog('error', 'Warning: Possible malformed path attack.')
         return [p for p in path.split('/') if p]
     return None
 
@@ -497,7 +505,6 @@
                 text = sdict.interpolate(utemplate)
         except (TypeError, ValueError), e:
             # The template is really screwed up
-            from Mailman.Logging.Syslog import syslog
             syslog('error', 'broken template: %s\n%s', filename, e)
             pass
     if raw:
1	--- mailman-2.1.5.1/Mailman/Utils.py.CVE-2006-4624 2007-05-21 16:23:13.000000000 +0200
2	+++ mailman-2.1.5.1/Mailman/Utils.py 2007-05-21 16:26:11.000000000 +0200
3	@@ -50,6 +50,7 @@
4	from Mailman import Errors
5	from Mailman import Site
6	from Mailman.SafeDict import SafeDict
7	+from Mailman.Logging.Syslog import syslog
8
9	try:
10	True, False
11	@@ -216,9 +217,16 @@
12
13
14
15	+# Patterns which may be used to form malicious path to inject a new
16	+# line in the mailman error log. (TK: advisory by Moritz Naumann)
17	+CRNLpat = re.compile(r'[^\x21-\x7e]')
18	+
19	def GetPathPieces(envar='PATH_INFO'):
20	path = os.environ.get(envar)
21	if path:
22	+ if CRNLpat.search(path):
23	+ path = CRNLpat.split(path)[0]
24	+ syslog('error', 'Warning: Possible malformed path attack.')
25	return [p for p in path.split('/') if p]
26	return None
27
28	@@ -497,7 +505,6 @@
29	text = sdict.interpolate(utemplate)
30	except (TypeError, ValueError), e:
31	# The template is really screwed up
32	- from Mailman.Logging.Syslog import syslog
33	syslog('error', 'broken template: %s\n%s', filename, e)
34	pass
35	if raw: