Re:Python bytecode is heavily trusted by CPython
by shanemhansen on Wednesday October 21, 2015 @10:19AM
(#10425550)
A very similar bug happened to rails. They parsed json using a yaml parser that loaded code. http://ronin-ruby.github.io/blog/2013/01/28/new-rails-poc.ht...
Re:Python bytecode is heavily trusted by CPython
by sp332 on Wednesday October 21, 2015 @08:33AM
(#10424967)
tkinom is just asking about the potential impact if this were a security problem.
Re:Python bytecode is heavily trusted by CPython
by orf on Wednesday October 21, 2015 @08:59AM
(#10425075)
He's asking about the potential impact of running untrusted bytecode?
Re:Python bytecode is heavily trusted by CPython
by sp332 on Wednesday October 21, 2015 @09:50AM
(#10425362)
Sure, this (hypothetical) exploit would be a lot more damaging if it were widespread.
Re:Python bytecode is heavily trusted by CPython
by orf on Wednesday October 21, 2015 @10:37AM
(#10425687)
Not really, because simply by running untrusted Python bytecode in any form you are exposing yourself to much worse than this. You're already past the airtight hatch[1], so it's pointless - "It's like saying that somebody's home windows are insecure because a burglar could get into the house by merely unlocking and opening the windows from the inside."
1. http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...
Obviously not, that would be the biggest security hole ever even without this issue.
> I think no-trivial CMS app server is writting in python.
There are plenty. And are you saying no CMS app should be written in Python because of this issue? Or are you suggesting everyone switch to PHP where it's 100x easier to shoot yourself in the foot (or head)?