Lucene search

K
centosCentOS ProjectCESA-2013:0589
HistoryMar 04, 2013 - 10:46 p.m.

emacs, git, gitk, gitweb, perl security update

2013-03-0422:46:35
CentOS Project
lists.centos.org
59

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

67.8%

CentOS Errata and Security Advisory CESA-2013:0589

Git is a fast, scalable, distributed revision control system.

It was discovered that Git’s git-imap-send command, a tool to send a
collection of patches from standard input (stdin) to an IMAP folder, did
not properly perform SSL X.509 v3 certificate validation on the IMAP
server’s certificate, as it did not ensure that the server’s hostname
matched the one provided in the CN field of the server’s certificate. A
rogue server could use this flaw to conduct man-in-the-middle attacks,
possibly leading to the disclosure of sensitive information.
(CVE-2013-0308)

All git users should upgrade to these updated packages, which contain a
backported patch to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2013-March/081780.html
https://lists.centos.org/pipermail/centos-cr-announce/2013-March/027088.html

Affected packages:
emacs-git
emacs-git-el
git
git-all
git-cvs
git-daemon
git-email
git-gui
git-svn
gitk
gitweb
perl-Git

Upstream details at:
https://access.redhat.com/errata/RHSA-2013:0589

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

67.8%