Fedora alert FEDORA-2013-8737 (python-backports-ssl_match_hostname)

From:
    	     
 
updates@fedoraproject.org 
To:
    	     
 
package-announce@lists.fedoraproject.org 
Subject:
    	     
 
[SECURITY] Fedora 17 Update:
	python-backports-ssl_match_hostname-3.2-0.3.a3.fc17 
Date:
    	     
 
Thu, 30 May 2013 03:06:17 +0000
Message-ID:
    	     
 
<20130530030616.3FCB120C26@bastion01.phx2.fedoraproject.org>
Archive-link:
    	     
 
Article, Thread
              
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-8737
2013-05-21 07:10:26
--------------------------------------------------------------------------------

Name        : python-backports-ssl_match_hostname
Product     : Fedora 17
Version     : 3.2
Release     : 0.3.a3.fc17
URL         : https://bitbucket.org/brandon/backports.ssl_match_hostname
Summary     : The ssl.match_hostname() function from Python 3.2
Description :
The Secure Sockets layer is only actually secure if you check the hostname in
the certificate returned by the server to which you are connecting, and verify
that it matches to hostname that you are trying to reach.

But the matching logic, defined in RFC2818, can be a bit tricky to implement on
your own. So the ssl package in the Standard Library of Python 3.2 now includes
a match_hostname() function for performing this check instead of requiring
every application to implement the check separately.

This backport brings match_hostname() to users of earlier versions of Python.
The actual code inside comes verbatim from Python 3.2.

--------------------------------------------------------------------------------
Update Information:

Fixes CVE-2013-2098 -- Denial of Service with SSL certificates which have specially crafted
wildcard patterns.
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #963186 - python-backports-ssl_match_hostname: Denial of service when matching
certificate with many '*' wildcard characters
        https://bugzilla.redhat.com/show_bug.cgi?id=963186
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update python-backports-ssl_match_hostname' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-...