diff -Nru elixir-0.7.1/debian/changelog elixir-0.7.1/debian/changelog --- elixir-0.7.1/debian/changelog 2014-03-02 00:07:29.000000000 +0000 +++ elixir-0.7.1/debian/changelog 2019-01-14 15:58:34.000000000 +0000 @@ -1,3 +1,36 @@ +elixir (0.7.1-4build0.14.04.1) trusty-security; urgency=medium + + * fake sync from Debian + + -- Mike Salvatore Mon, 14 Jan 2019 10:58:34 -0500 + +elixir (0.7.1-4) unstable; urgency=high + + * Team upload. + + [ Ondřej Nový ] + * Fixed VCS URL (https) + + [ Piotr Ożarowski ] + * Apply fix for CVE-2012-2146 from RedHat's bugzilla (closes: 670919) + (https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2146) + + -- Ondřej Nový Tue, 29 Mar 2016 21:29:24 +0200 + +elixir (0.7.1-3) unstable; urgency=medium + + * Team upload. + + [ Piotr Ożarowski ] + * Remove myself from Uploaders + + [ Scott Kitterman ] + * Rebuild for sqlalchemy 1.0 + * Update debian/watch to use pypi.debian.net redirector + * Add python-crypto to build-depends for test execution + + -- Scott Kitterman Sat, 01 Aug 2015 21:34:44 -0400 + elixir (0.7.1-2) unstable; urgency=low [ Jakub Wilk ] diff -Nru elixir-0.7.1/debian/control elixir-0.7.1/debian/control --- elixir-0.7.1/debian/control 2014-03-02 00:00:21.000000000 +0000 +++ elixir-0.7.1/debian/control 2016-03-29 19:29:24.000000000 +0000 @@ -2,13 +2,13 @@ Section: python Priority: optional Maintainer: Debian Python Modules Team -Uploaders: Piotr Ożarowski , Gustavo Noronha Silva +Uploaders: Gustavo Noronha Silva Build-Depends: debhelper (>= 9), dh-python, python-all (>= 2.3.5-11), python-setuptools (>= 0.6b3), # tests: - python-sqlalchemy, python-nose + python-sqlalchemy, python-nose, python-crypto Standards-Version: 3.9.5 -Vcs-Svn: svn://anonscm.debian.org/python-modules/packages/elixir/trunk/ -Vcs-Browser: http://anonscm.debian.org/viewvc/python-modules/packages/elixir/trunk/ +Vcs-Git: https://anonscm.debian.org/git/python-modules/packages/elixir.git +Vcs-Browser: https://anonscm.debian.org/cgit/python-modules/packages/elixir.git Homepage: http://elixir.ematia.de/ X-Python-Version: >= 2.4 diff -Nru elixir-0.7.1/debian/.git-dpm elixir-0.7.1/debian/.git-dpm --- elixir-0.7.1/debian/.git-dpm 1970-01-01 00:00:00.000000000 +0000 +++ elixir-0.7.1/debian/.git-dpm 2016-03-29 19:29:24.000000000 +0000 @@ -0,0 +1,11 @@ +# see git-dpm(1) from git-dpm package +3a06ca56dc701e244c7e5240afc84f434aaa6b3d +3a06ca56dc701e244c7e5240afc84f434aaa6b3d +3dcd3abf09121451b9cc81cb1a7b4daad7a36f9f +3dcd3abf09121451b9cc81cb1a7b4daad7a36f9f +elixir_0.7.1.orig.tar.gz +22a1fbdc0163532b7cfbbd54c074a0a5ccf7d060 +47110 +debianTag="debian/%e%v" +patchedTag="patched/%e%v" +upstreamTag="upstream/%e%u" diff -Nru elixir-0.7.1/debian/patches/0002-CVE-2012-2146-aes-encryption-addition.patch elixir-0.7.1/debian/patches/0002-CVE-2012-2146-aes-encryption-addition.patch --- elixir-0.7.1/debian/patches/0002-CVE-2012-2146-aes-encryption-addition.patch 1970-01-01 00:00:00.000000000 +0000 +++ elixir-0.7.1/debian/patches/0002-CVE-2012-2146-aes-encryption-addition.patch 2016-03-29 19:29:24.000000000 +0000 @@ -0,0 +1,91 @@ +From 3a06ca56dc701e244c7e5240afc84f434aaa6b3d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Piotr=20O=C5=BCarowski?= +Date: Fri, 18 Nov 2016 14:02:47 +0100 +Subject: CVE-2012-2146: aes encryption addition + +--- + elixir/ext/encrypted.py | 42 +++++++++++++++++++++++++++++++++++++----- + 1 file changed, 37 insertions(+), 5 deletions(-) + +diff --git a/elixir/ext/encrypted.py b/elixir/ext/encrypted.py +index 410855d..ec99fbf 100644 +--- a/elixir/ext/encrypted.py ++++ b/elixir/ext/encrypted.py +@@ -32,7 +32,9 @@ that attribute will be crypted in the in-memory object in addition to the + database row. + ''' + +-from Crypto.Cipher import Blowfish ++import sys ++import os ++from Crypto.Cipher import Blowfish, AES + from elixir.statements import Statement + from sqlalchemy.orm import MapperExtension, EXT_CONTINUE, EXT_STOP + +@@ -49,7 +51,9 @@ __doc_all__ = [] + # + # encryption and decryption functions + # +- ++# WARNING!!! Blowfish encryption method is vulnerable to attacks ++# because it doesn't properly use random seed. It is provided just for ++# backward compatibility needed to migrate data. Use AES instead! + def encrypt_value(value, secret): + return Blowfish.new(secret, Blowfish.MODE_CFB) \ + .encrypt(value).encode('string_escape') +@@ -58,6 +62,24 @@ def decrypt_value(value, secret): + return Blowfish.new(secret, Blowfish.MODE_CFB) \ + .decrypt(value.decode('string_escape')) + ++# Crypto.Cipher.AES is AES128 ++def encrypt_value_aes(value, secret): ++ iv = os.urandom(AES.block_size) ++ ++ pad_len = AES.block_size - len(value) % AES.block_size ++ padded_value = value + pad_len * chr(pad_len) ++ res = iv + AES.new(secret, AES.MODE_CBC, iv).encrypt(padded_value) ++ return res.encode('string_escape') ++ ++def decrypt_value_aes(value, secret): ++ value = value.decode('string_escape') ++ iv = value[:AES.block_size] ++ encrypted = value[AES.block_size:] ++ ++ padded_value = AES.new(secret, AES.MODE_CBC, iv).decrypt(encrypted) ++ pad_len = ord(padded_value[-1]) ++ assert pad_len >= 1 and pad_len <= AES.block_size ++ return padded_value[:-pad_len] + + # + # acts_as_encrypted statement +@@ -65,7 +87,11 @@ def decrypt_value(value, secret): + + class ActsAsEncrypted(object): + +- def __init__(self, entity, for_fields=[], with_secret='abcdef'): ++ def __init__(self, entity, for_fields=[], with_secret='abcdef', with_aes=False): ++ if not with_aes: ++ sys.stderr.write("""******* WARNING!!! ******** ++Blowfish encryption method is vulnerable to attacks. ++Migrate your data and use with_aes=True\n""") + + def perform_encryption(instance, encrypt=True): + encrypted = getattr(instance, '_elixir_encrypted', None) +@@ -77,9 +103,15 @@ class ActsAsEncrypted(object): + instance._elixir_encrypted = encrypt + + if encrypt: +- func = encrypt_value ++ if with_aes: ++ func = encrypt_value_aes ++ else: ++ func = encrypt_value + else: +- func = decrypt_value ++ if with_aes: ++ func = decrypt_value_aes ++ else: ++ func = decrypt_value + + for column_name in for_fields: + current_value = getattr(instance, column_name) diff -Nru elixir-0.7.1/debian/patches/sa_0.9_compatibility.patch elixir-0.7.1/debian/patches/sa_0.9_compatibility.patch --- elixir-0.7.1/debian/patches/sa_0.9_compatibility.patch 2014-03-01 23:38:53.000000000 +0000 +++ elixir-0.7.1/debian/patches/sa_0.9_compatibility.patch 2016-03-29 19:29:24.000000000 +0000 @@ -1,7 +1,18 @@ -Index: elixir-0.7.1/elixir/entity.py -=================================================================== ---- elixir-0.7.1.orig/elixir/entity.py -+++ elixir-0.7.1/elixir/entity.py +From 2c43934c7dfba603a841a86989cd13ab7ded2e8b Mon Sep 17 00:00:00 2001 +From: SVN-Git Migration +Date: Thu, 8 Oct 2015 09:01:26 -0700 +Subject: sa_0.9_compatibility + +Patch-Name: sa_0.9_compatibility.patch +--- + elixir/entity.py | 6 +++--- + elixir/options.py | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/elixir/entity.py b/elixir/entity.py +index 5057457..1f4e5fb 100644 +--- a/elixir/entity.py ++++ b/elixir/entity.py @@ -15,7 +15,7 @@ import sqlalchemy from sqlalchemy import Table, Column, Integer, desc, ForeignKey, and_, \ ForeignKeyConstraint @@ -27,11 +38,11 @@ "management." % self.entity.__name__) -Index: elixir-0.7.1/elixir/options.py -=================================================================== ---- elixir-0.7.1.orig/elixir/options.py -+++ elixir-0.7.1/elixir/options.py -@@ -116,7 +116,7 @@ The list of supported arguments are as f +diff --git a/elixir/options.py b/elixir/options.py +index 9284b04..948b568 100644 +--- a/elixir/options.py ++++ b/elixir/options.py +@@ -116,7 +116,7 @@ The list of supported arguments are as follows: | ``session`` | Specify a custom contextual session for this entity. | | | By default, entities uses the global | | | ``elixir.session``. | diff -Nru elixir-0.7.1/debian/patches/series elixir-0.7.1/debian/patches/series --- elixir-0.7.1/debian/patches/series 2014-03-01 23:37:08.000000000 +0000 +++ elixir-0.7.1/debian/patches/series 2016-03-29 19:29:24.000000000 +0000 @@ -1 +1,2 @@ sa_0.9_compatibility.patch +0002-CVE-2012-2146-aes-encryption-addition.patch diff -Nru elixir-0.7.1/debian/watch elixir-0.7.1/debian/watch --- elixir-0.7.1/debian/watch 2014-03-01 23:34:51.000000000 +0000 +++ elixir-0.7.1/debian/watch 2016-03-29 19:29:24.000000000 +0000 @@ -1,2 +1,2 @@ version=3 -http://pypi.python.org/packages/source/E/Elixir/Elixir-(.*)\.tar\.gz debian uupdate +http://pypi.debian.net/Elixir/Elixir-(.*)\.tar\.gz debian uupdate