MGASA-2013-0250

    Dashboard / Vulnerabilities / MGASA-2013-0250

    MGASA-2013-0250

    Published: 17 Aug 2013Last Modified: 16 Apr 2026
    Upstream:
    CVE-2013-4238

    Summary: Updated python packages fix CVE-2013-4238 and pip

    Details: Updated python packages fix security vulnerability: Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificate's subjectAltName's dNSName general names. (CVE-2013-4238). Additionally, an issue with installing Python packages with C extensions via pip and virtualenv has been fixed in Mageia 3 (mga#10102).

    References: https://advisories.mageia.org/MGASA-2013-0250.html, http://bugs.python.org/issue18709, https://bugs.mageia.org/show_bug.cgi?id=10102, https://bugs.mageia.org/show_bug.cgi?id=10989

    Affected packages

    Package

    Name: python

    Purl: pkg:rpm/mageia/python?arch=source&distro=mageia-2

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.7.3-2.4.mga2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High