Mageia alert MGASA-2013-0252 (python3)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0252: Updated python3, bzr and some python packages fix security vulnerabilties 
Date:
    	     
 
Thu, 22 Aug 2013 19:58:16 +0200
Message-ID:
    	     
 
<20130822175816.E48DF42FEF@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0252 - Updated python3, bzr and some python packages fix security vulnerabilties

Publication date: 22 Aug 2013
URL: http://advisories.mageia.org/MGASA-2013-0252.html
Type: security
Affected Mageia releases: 2, 3
CVE: CVE-2013-2099,
     CVE-2013-4328

Description:
Updated python3 packages fix security vulnerabilities:

A denial of service flaw was found in the way SSL module implementation of
Python 3 performed matching of the certificate's name in the case it contained
many '*' wildcard characters. A remote attacker, able to obtain valid
certificate with its name containing a lot of '*' wildcard characters could use
this flaw to cause denial of service (excessive CPU consumption) by issuing
request to validate such a certificate for / to an application using the
Python's ssl.match_hostname() functionality (CVE-2013-2099).

Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL
module doesn't handle NULL bytes inside subjectAltNames general names. This
could lead to a breach when an application uses ssl.match_hostname() to match
the hostname againt the certificate's subjectAltName's dNSName general names.
(CVE-2013-4328).

Additionally, a linking issue when compiling C extensions for Python 3 has been
fixed in Mageia 3 (mga#9395).

The CVE-2013-2099 issue also affects bzr, python-requests, python-tornado,
python-pip, and python-virtualenv, and those have been updated as well.

References:
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2099
- http://bugs.python.org/issue18709
- https://bugs.mageia.org/show_bug.cgi?id=9395
- https://bugs.mageia.org/show_bug.cgi?id=10989
- https://lists.fedoraproject.org/pipermail/package-announc...
- https://bugs.mageia.org/show_bug.cgi?id=10391
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2099
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4328

SRPMS:
- 3/core/python3-3.3.0-4.3.mga3
- 3/core/python-pip-1.3.1-2.1.mga3
- 3/core/python-tornado-2.3-2.1.mga3
- 3/core/bzr-2.5.1-3.1.mga3
- 3/core/python-requests-0.13.5-2.1.mga3
- 3/core/python-virtualenv-1.9.1-1.2.mga3
- 2/core/python3-3.2.3-1.5.mga2
- 2/core/python-tornado-2.2.1-1.1.mga2
- 2/core/bzr-2.5.1-1.1.mga2