Lucene search

K
mageiaGentoo FoundationMGASA-2013-0252
HistoryAug 22, 2013 - 9:58 p.m.

Updated python3, bzr and some python packages fix security vulnerabilties

2013-08-2221:58:14
Gentoo Foundation
advisories.mageia.org
9

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.053 Low

EPSS

Percentile

93.0%

Updated python3 packages fix security vulnerabilities: A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificateโ€™s name in the case it contained many โ€˜โ€™ wildcard characters. A remote attacker, able to obtain valid certificate with its name containing a lot of 'โ€™ wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Pythonโ€™s ssl.match_hostname() functionality (CVE-2013-2099). Ryan Sleevi of the Google Chrome Security Team has discovered that Pythonโ€™s SSL module doesnโ€™t handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificateโ€™s subjectAltNameโ€™s dNSName general names. (CVE-2013-4238). Additionally, a linking issue when compiling C extensions for Python 3 has been fixed in Mageia 3 (mga#9395). The CVE-2013-2099 issue also affects bzr, python-requests, python-tornado, python-pip, and python-virtualenv, and those have been updated as well.

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.053 Low

EPSS

Percentile

93.0%