Index: vuln.xml =================================================================== --- vuln.xml (revision 327053) +++ vuln.xml (working copy) @@ -51,6 +51,39 @@ --> + + py-openssl -- hostname check bypassing vulnerability + + + py-openssl + + 0.13.1 + + + + + +

Christian Heimes reports:

+
+

The ssl.match_hostname function in the SSL module in Python 2.6 + through 3.4 does not properly handle a '\0' character in a domain + name in the Subject Alternative Name field of an X.509 certificate + which allows man-in-the-middle attackers to spoof arbitrary SSL + servers via a crafted certificate issued by a legitimate + Certification Authority.

+
+ + + + CVE-2013-4238 + http://bugs.python.org/issue18709 + + + 2013-08-12 + 2013-09-12 + + + svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.