Lucene search

K
mageiaGentoo FoundationMGASA-2013-0250
HistoryAug 17, 2013 - 12:43 p.m.

Updated python packages fix CVE-2013-4328 and pip

2013-08-1712:43:24
Gentoo Foundation
advisories.mageia.org
10

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.8%

Updated python packages fix security vulnerability: Ryan Sleevi of the Google Chrome Security Team has discovered that Pythonโ€™s SSL module doesnโ€™t handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificateโ€™s subjectAltNameโ€™s dNSName general names. (CVE-2013-4238). Additionally, an issue with installing Python packages with C extensions via pip and virtualenv has been fixed in Mageia 3 (mga#10102).

OSVersionArchitecturePackageVersionFilename
Mageia2noarchpython<ย 2.7.3-2.4python-2.7.3-2.4.mga2
Mageia3noarchpython<ย 2.7.5-1.2python-2.7.5-1.2.mga3

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.8%