Bug 886001 (CVE-2013-2099) - VUL-0: CVE-2013-2099: python3: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns
Summary: VUL-0: CVE-2013-2099: python3: ssl.match_hostname() DoS via certificates with...
Status: RESOLVED FIXED
Alias: CVE-2013-2099
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.1
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/90980/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-07 10:30 UTC by Johannes Segitz
Modified: 2014-08-28 09:05 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2014-07-07 10:30:59 UTC
A remote attacker, able to obtain valid certificate with its name containing a lot of '*' wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Python's ssl.match_hostname() functionality.

Upstream patch: 
http://hg.python.org/cpython/rev/fafd33db6ff6

References:
https://bugzilla.redhat.com/show_bug.cgi?id=963260
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2099
http://www.openwall.com/lists/oss-security/2013/05/16/6
http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-2099.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2099
http://secunia.com/advisories/55107
http://secunia.com/advisories/55116
http://www.ubuntu.com/usn/USN-1983-1
http://www.ubuntu.com/usn/USN-1984-1
http://www.ubuntu.com/usn/USN-1985-1
http://bugs.python.org/issue17980
Comment 1 Swamp Workflow Management 2014-07-07 22:00:41 UTC
bugbot adjusting priority
Comment 2 Jan Matejek 2014-07-23 16:24:07 UTC
SLE12, Factory and 13.1 versions are already fixed.
12.3 is vulnerable.

This doesn't seem too severe - is it OK if we keep 12.3 unfixed?
Comment 3 Johannes Segitz 2014-07-24 07:35:01 UTC
I would prefer a fix but since it's "just a DoS" (and one that probably won't see much use) it's fine
Comment 4 Bernhard Wiedemann 2014-08-06 15:00:37 UTC
This is an autogenerated message for OBS integration:
This bug (886001) was mentioned in
https://build.opensuse.org/request/show/243787 12.3 / python3
Comment 5 Jan Matejek 2014-08-07 11:51:21 UTC
fixed in 12.3 along with bug 885882
handing over to security
Comment 6 Victor Pereira 2014-08-28 08:47:38 UTC
relased
Comment 7 Swamp Workflow Management 2014-08-28 09:05:43 UTC
openSUSE-SU-2014:1070-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 885882,886001
CVE References: CVE-2013-2099,CVE-2014-4650
Sources used:
openSUSE 12.3 (src):    python3-3.3.0-6.23.1, python3-base-3.3.0-6.23.1, python3-doc-3.3.0-6.23.1