1409756 - update infra to python 2.7.14

Status: RESOLVED WONTFIX

(Socorro :: Infra, task)

Description

[Will Kahn-Greene [:willkg] ET needinfo? me]

+++ This bug was initially created as a clone of Bug #1409745 +++

We're using python 2.7.11 on server nodes. We should upgrade to 2.7.14.

Changes in Python between 2.7.11 and 2.7.14:

https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS

There are a few security-related bits there. I don't know offhand if those affect us.

We should update if we can.

Comment 1

[Will Kahn-Greene [:willkg] ET needinfo? me]

I helped with the last upgrade. 2.7.11 to 2.7.14 shouldn't be as difficult especially since we're using our own compiled version now. I don't know if it's a one-day project or one-week project, though.

Comment 2

[Greg G]

Security issues since 2.7.11 include a windows env var injection issue, two expat xml parser updates, and a fix to urllib.splithost parsing:

[Security] bpo-30730: Prevent environment variables injection in subprocess on Windows.  Prevent passing other environment variables and command arguments.

[Security] bpo-30694: Upgrade expat copy from 2.2.0 to 2.2.1 to get fixes of multiple security vulnerabilities including: CVE-2017-9233 (External entity infinite loop DoS), CVE-2016-9063 (Integer overflow, re-fix), ...

[Security] bpo-30500: Fix urllib.splithost() to correctly parse fragments. For example, ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the ``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an authentification (``login@host``).
  
[Security] bpo-29591: Update expat copy from 2.1.1 to 2.2.0 to get fixes of CVE-2016-0718 and CVE-2016-4472. See https://sourceforge.net/p/expat/bugs/537/ for more information.


We aren't using either of those libraries directly and will get updates to any dependencies that do:

https://github.com/mozilla-services/tecken/search?utf8=%E2%9C%93&q=expat&type=
https://github.com/mozilla-services/socorro/search?utf8=%E2%9C%93&q=expat&type=

https://github.com/mozilla-services/socorro/search?utf8=%E2%9C%93&q=splithost&type=
https://github.com/mozilla-services/tecken/search?utf8=%E2%9C%93&q=splithost&type=

So I don't think we need to upgrade right away for any security fixes. 


$ grep -n 2.7.11 NEWS
1060:What's New in Python 2.7.11?
1072:What's New in Python 2.7.11 release candidate 1?
$ # 2.7.11 changes start on line 1060
$ head -1060 NEWS | grep -ina2 '\[Security\]'
67-  ``os.putenv()`` and ``os.spawn*()``.
68-
69:- [Security] bpo-30730: Prevent environment variables injection in subprocess on
70-  Windows.  Prevent passing other environment variables and command arguments.
71-
--
--
70-  Windows.  Prevent passing other environment variables and command arguments.
71-
72:- [Security] bpo-30694: Upgrade expat copy from 2.2.0 to 2.2.1 to get fixes
73-  of multiple security vulnerabilities including: CVE-2017-9233 (External
74-  entity infinite loop DoS), CVE-2016-9063 (Integer overflow, re-fix),
--
--
79-  the expat secret using ``XML_SetHashSalt()``.
80-
81:- [Security] bpo-30500: Fix urllib.splithost() to correctly parse
82-  fragments. For example, ``splithost('//127.0.0.1#@evil.com/')`` now
83-  correctly returns the ``127.0.0.1`` host, instead of treating ``@evil.com``
--
--
84-  as the host in an authentification (``login@host``).
85-
86:- [Security] bpo-29591: Update expat copy from 2.1.1 to 2.2.0 to get fixes
87-  of CVE-2016-0718 and CVE-2016-4472. See
88-  https://sourceforge.net/p/expat/bugs/537/ for more information.

Comment 3

[Miles Crabill [:miles]]

This bug applies to RPM built Socorro, which we're moving away from. Dockerized Socorro already uses 2.7.14. WONTFIXing.