Mageia alert MGASA-2013-0250 (python)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0250: Updated python packages fix CVE-2013-4328 and pip 
Date:
    	     
 
Sat, 17 Aug 2013 10:43:27 +0200
Message-ID:
    	     
 
<20130817084327.3FFF8486B4@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0250 - Updated python packages fix CVE-2013-4328 and pip

Publication date: 17 Aug 2013
URL: http://advisories.mageia.org/MGASA-2013-0250.html
Type: security
Affected Mageia releases: 2, 3
CVE: CVE-2013-4328

Description:
Updated python packages fix security vulnerability:

Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL
module doesn't handle NULL bytes inside subjectAltNames general names. This
could lead to a breach when an application uses ssl.match_hostname() to match
the hostname againt the certificate's subjectAltName's dNSName general names.
(CVE-2013-4328).

Additionally, an issue with installing Python packages with C extensions via
pip and virtualenv has been fixed in Mageia 3 (mga#10102).

References:
- http://bugs.python.org/issue18709
- https://bugs.mageia.org/show_bug.cgi?id=10102
- https://bugs.mageia.org/show_bug.cgi?id=10989
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4328

SRPMS:
- 3/core/python-2.7.5-1.2.mga3
- 2/core/python-2.7.3-2.4.mga2