Stay Secure with the Latest Linux Advisories

security advisorydebiancritical threat

Debian DSA-2763-1 Critical: PyOpenSSL Hostname Bypass Remote Threat

It was discovered that PyOpenSSL, a Python wrapper around the OpenSSL library, does not properly handle certificates with NULL characters in the Subject Alternative Name field. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-2763-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Salvatore Bonaccorso September 24, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : pyopenssl Vulnerability : hostname check bypassing Problem type : remote Debian-specific: no CVE ID : CVE-2013-4314 Debian Bug : 722055 It was discovered that PyOpenSSL, a Python wrapper around the OpenSSL library, does not properly handle certificates with NULL characters in the Subject Alternative Name field. A remote attacker in the position to obtain a certificate for 'www.foo.org\0.' from a CA that a SSL client trusts, could use this to spoof 'www.foo.org' and conduct man-in-the-middle attacks between the PyOpenSSL-using client and the SSL server. For the oldstable distribution (squeeze), this problem has been fixed in version 0.10-1+squeeze1. For the stable distribution (wheezy), this problem has been fixed in version 0.13-2+deb7u1. For the unstable distribution (sid), this problem has been fixed in version 0.13-2.1. We recommend that you upgrade your pyopenssl packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Urgent notice DSA-4765-3 regarding PyCrypto highlights a serious encryption key management flaw threatening overall system integrity.. Debian Security, Host Bypass, PyOpenSSL Updates. . Severity: Critical. LinuxSecurity.com Team

Sep 24, 2013 •Critical Debian