4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.053 Low
EPSS
Percentile
93.0%
Updated python3 packages fix security vulnerabilities: A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificateโs name in the case it contained many โโ wildcard characters. A remote attacker, able to obtain valid certificate with its name containing a lot of 'โ wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Pythonโs ssl.match_hostname() functionality (CVE-2013-2099). Ryan Sleevi of the Google Chrome Security Team has discovered that Pythonโs SSL module doesnโt handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificateโs subjectAltNameโs dNSName general names. (CVE-2013-4238). Additionally, a linking issue when compiling C extensions for Python 3 has been fixed in Mageia 3 (mga#9395). The CVE-2013-2099 issue also affects bzr, python-requests, python-tornado, python-pip, and python-virtualenv, and those have been updated as well.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 2 | noarch | python3 | <ย 3.2.3-1.5 | python3-3.2.3-1.5.mga2 |
Mageia | 2 | noarch | python-tornado | <ย 2.2.1-1.1 | python-tornado-2.2.1-1.1.mga2 |
Mageia | 2 | noarch | bzr | <ย 2.5.1-1.1 | bzr-2.5.1-1.1.mga2 |
Mageia | 3 | noarch | python3 | <ย 3.3.0-4.3 | python3-3.3.0-4.3.mga3 |
Mageia | 3 | noarch | python-pip | <ย 1.3.1-2.1 | python-pip-1.3.1-2.1.mga3 |
Mageia | 3 | noarch | python-tornado | <ย 2.3-2.1 | python-tornado-2.3-2.1.mga3 |
Mageia | 3 | noarch | bzr | <ย 2.5.1-3.1 | bzr-2.5.1-3.1.mga3 |
Mageia | 3 | noarch | python-requests | <ย 0.13.5-2.1 | python-requests-0.13.5-2.1.mga3 |
Mageia | 3 | noarch | python-virtualenv | <ย 1.9.1-1.2 | python-virtualenv-1.9.1-1.2.mga3 |