MGASA-2013-0252

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2013-0252.html
Import Source
https://advisories.mageia.org/MGASA-2013-0252.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2013-0252
Related
Published
2013-08-22T17:58:14Z
Modified
2013-08-26T19:14:32Z
Summary
Updated python3, bzr and some python packages fix security vulnerabilties
Details

Updated python3 packages fix security vulnerabilities:

A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificate's name in the case it contained many '' wildcard characters. A remote attacker, able to obtain valid certificate with its name containing a lot of '' wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Python's ssl.match_hostname() functionality (CVE-2013-2099).

Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificate's subjectAltName's dNSName general names. (CVE-2013-4238).

Additionally, a linking issue when compiling C extensions for Python 3 has been fixed in Mageia 3 (mga#9395).

The CVE-2013-2099 issue also affects bzr, python-requests, python-tornado, python-pip, and python-virtualenv, and those have been updated as well.

References
Credits

Affected packages

Mageia:3 / python3

Package

Name
python3
Purl
pkg:rpm/mageia/python3?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.0-4.3.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / python-pip

Package

Name
python-pip
Purl
pkg:rpm/mageia/python-pip?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.1-2.1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / python-tornado

Package

Name
python-tornado
Purl
pkg:rpm/mageia/python-tornado?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3-2.1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / bzr

Package

Name
bzr
Purl
pkg:rpm/mageia/bzr?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.1-3.1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / python-requests

Package

Name
python-requests
Purl
pkg:rpm/mageia/python-requests?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.13.5-2.1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:rpm/mageia/python-virtualenv?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.9.1-1.2.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / python3

Package

Name
python3
Purl
pkg:rpm/mageia/python3?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.3-1.5.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / python-tornado

Package

Name
python-tornado
Purl
pkg:rpm/mageia/python-tornado?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.1-1.1.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / bzr

Package

Name
bzr
Purl
pkg:rpm/mageia/bzr?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.1-1.1.mga2

Ecosystem specific 

{
    "section": "core"
}