TEMP-0605160-28DAD2

Name	TEMP-0605160-28DAD2
Description	insecure python path handling
Source	Automatically generated temporary name. Not for external reference.
Debian Bugs	605150, 605151, 605152, 605153, 605157, 605158, 605159, 605160, 605161, 605163, 605168, 605169

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
calendarserver (PTS)	buster	9.2+dfsg-1	fixed
distcc (PTS)	jessie	3.1-6.1	fixed
	stretch	3.1-6.2	fixed
	buster	3.3.2-10+deb10u1	fixed
	bullseye	3.4+really3.3.5-3	fixed
	bookworm	3.4+really3.4-3	fixed
	sid, trixie	3.4+really3.4-9	fixed
gnome-schedule (PTS)	jessie	2.1.1-4	fixed
gnumed-client (PTS)	jessie	1.4.12+dfsg-1	fixed
	stretch	1.6.11+dfsg-3	fixed
	buster	1.7.5+dfsg-3	fixed
	bullseye	1.8.5+dfsg-2	fixed
	bookworm	1.8.9+dfsg-1	fixed
	sid, trixie	1.8.19+dfsg-1	fixed
gquilt (PTS)	jessie, stretch	0.25-4	fixed
guake (PTS)	jessie	0.4.4-1	fixed
	stretch	0.8.8-1	fixed
	buster	3.4.0-1	fixed
	bullseye	3.6.3-2	fixed
	bookworm	3.9.0-2	fixed
	sid, trixie	3.10-2	fixed
mmass (PTS)	jessie	5.5.0-4	fixed
	buster, stretch	5.5.0-5	fixed
opendnssec (PTS)	jessie	1:1.4.6-6	fixed
	stretch	1:2.0.4-3	fixed
	buster	1:2.1.3-2	fixed
	bullseye	1:2.1.7-2	fixed
	bookworm	1:2.1.12-2	fixed
	sid, trixie	1:2.1.13-1.2	fixed
pybliographer (PTS)	jessie, stretch	1.2.16-1	fixed
pymca (PTS)	jessie	4.7.4+dfsg-1	fixed
	stretch	5.1.3+dfsg-1	fixed
	buster	5.4.3+dfsg-1	fixed
	bullseye	5.6.3+dfsg-1	fixed
	bookworm	5.8.0+dfsg-2	fixed
	sid, trixie	5.9.3+dfsg-1	fixed
snappea (PTS)	jessie	3.0d3-23	fixed
	buster, stretch	3.0d3-24	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
calendarserver	source	(unstable)	2.4.dfsg-2.1	low	605157
distcc	source	lenny	(not affected)
distcc	source	(unstable)	3.1-3.2	low	605168
dlr-languages	source	(unstable)	20090805+git.e6b28d27+dfsg-3	low	605158
gnome-schedule	source	(unstable)	2.1.1-3.1	low	605169
gnumed-client	source	squeeze	0.7.10-1
gnumed-client	source	(unstable)	0.8.5-1	low	605159
gquilt	source	lenny	0.20-2+lenny1
gquilt	source	(unstable)	0.22-1.1	low	605152
guake	source	(unstable)	0.4.2-3	low	605163
mmass	source	squeeze	(not affected)
mmass	source	(unstable)	3.8.0-2	low	605150
opendnssec	source	(unstable)	1.1.3-2	low	605161
pybliographer	source	squeeze	1.2.12-4squeeze1
pybliographer	source	(unstable)	1.2.14-3	low	605153
pymca	source	(unstable)	4.4.1p1-1	low	605160
snappea	source	(unstable)	3.0d3-20	low	605151

Notes

[lenny] - calendarserver <no-dsa> (Minor issue)
[lenny] - snappea <no-dsa> (Minor issue)
[lenny] - ironpython <no-dsa> (Minor issue)
[lenny] - gnome-schedule <no-dsa> (Minor issue)
[lenny] - gnumed-client <no-dsa> (Minor issue)
[lenny] - distcc <not-affected> (Vulnerable code not present)
[squeeze] - mmass <not-affected> (Doesn't set PYTHONPATH)