Ubuntu Security Notice 1965-1 - It was discovered that pyOpenSSL did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.
9a62177c15f37e7c4836b84c5bef097ee6d8aade227639bbf1331a5b2718f5f8
============================================================================
Ubuntu Security Notice USN-1965-1
September 23, 2013
pyopenssl vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Fraudulent security certificates could allow sensitive information to be
exposed when accessing the Internet.
Software Description:
- pyopenssl: Python wrapper around the OpenSSL library
Details:
It was discovered that pyOpenSSL did not properly handle certificates with
NULL characters in the Subject Alternative Name field. An attacker could
exploit this to perform a man in the middle attack to view sensitive
information or alter encrypted communications.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.04:
python-openssl 0.13-2ubuntu3.1
python3-openssl 0.13-2ubuntu3.1
Ubuntu 12.10:
python-openssl 0.13-2ubuntu1.1
python3-openssl 0.13-2ubuntu1.1
Ubuntu 12.04 LTS:
python-openssl 0.12-1ubuntu2.1
Ubuntu 10.04 LTS:
python-openssl 0.10-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1965-1
CVE-2013-4314
Package Information:
https://launchpad.net/ubuntu/+source/pyopenssl/0.13-2ubuntu3.1
https://launchpad.net/ubuntu/+source/pyopenssl/0.13-2ubuntu1.1
https://launchpad.net/ubuntu/+source/pyopenssl/0.12-1ubuntu2.1
https://launchpad.net/ubuntu/+source/pyopenssl/0.10-1ubuntu0.1