MGASA-2013-0252

Dashboard / Vulnerabilities / MGASA-2013-0252

MGASA-2013-0252

Summary: Updated python3, bzr and some python packages fix security vulnerabilties

Details: Updated python3 packages fix security vulnerabilities: A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificate's name in the case it contained many '*' wildcard characters. A remote attacker, able to obtain valid certificate with its name containing a lot of '*' wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Python's ssl.match_hostname() functionality (CVE-2013-2099). Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificate's subjectAltName's dNSName general names. (CVE-2013-4238). Additionally, a linking issue when compiling C extensions for Python 3 has been fixed in Mageia 3 (mga#9395). The CVE-2013-2099 issue also affects bzr, python-requests, python-tornado, python-pip, and python-virtualenv, and those have been updated as well.

References: https://advisories.mageia.org/MGASA-2013-0252.html, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2099, http://bugs.python.org/issue18709, https://bugs.mageia.org/show_bug.cgi?id=9395, https://bugs.mageia.org/show_bug.cgi?id=10989, https://lists.fedoraproject.org/pipermail/package-announce/2013-June/107957.html, https://bugs.mageia.org/show_bug.cgi?id=10391