Ubuntu One Client regression

2012-06-0600:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.009

Percentile

82.8%

JSON

Releases

Ubuntu 10.04

Packages

ubuntuone-client - Ubuntu One client

Details

USN-1465-1 fixed vulnerabilities in Ubuntu One Client. The update failed to
install on certain Ubuntu 10.04 LTS systems that had a legacy Python 2.5
package installed. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that the Ubuntu One Client incorrectly validated server
certificates when using HTTPS connections. If a remote attacker were able
to perform a machine-in-the-middle attack, this flaw could be exploited to
alter or compromise confidential information.

OSVersionArchitecturePackageVersionFilename
Ubuntu10.04noarchpython-ubuntuone-client< 1.2.2-0ubuntu2.3UNKNOWN
Ubuntu10.04noarchubuntuone-client-gnome< 1.2.2-0ubuntu2.3UNKNOWN