[Python-modules-team] Bug#722055: python-openssl: CVE-2013-4314: hostname check bypassing vulnerability

[Henri Salo]

Package: python-openssl
Version: 0.13-2+b2
Severity: important
Tags: security, fixed-upstream

https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html

In all prior releases, the string formatting of subjectAltName
X509Extension instances incorrectly truncated fields of the name when
encountering NUL.  String formatting of this extension will now include
the NUL byte (escaped) and any following bytes.

Additionally, a bug causing memory to be leaked for each call to
X509.get_extension has been fixed.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1005325

Please adjust affected version numbers accordingly.

---
Henri Salo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/python-modules-team/attachments/20130907/208e3b40/attachment-0001.sig>