drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Denial of Service in python-pip
Name: |
Denial of Service in python-pip |
|
ID: |
FEDORA-2013-13213 |
|
Distribution: |
Fedora |
|
Plattformen: |
Fedora 17 |
|
Datum: |
Fr, 26. Juli 2013, 07:40 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2099 |
|
Applikationen: |
pip |
|
Originalnachricht |
Name : python-pip Product : Fedora 17 Version : 1.3.1 Release : 4.fc17 URL : http://www.pip-installer.org Summary : A tool for installing and managing Python packages Description : Pip is a replacement for `easy_install <http://peak.telecommunity.com/DevCenter/EasyInstall>`_. It uses mostly the same techniques for finding packages, so packages that were made easy_installable should be pip-installable as well.
------------------------------------------------------------------------------- - Update Information:
Fix potential DOS with specially crafted malicious SSL certs. Backing out rename of pip binary to fix #958377 and updating package summary to match upstream's description. Backing out rename of pip binary to fix #958377 and updating package summary to match upstream's description. ------------------------------------------------------------------------------- - ChangeLog:
* Tue Jul 16 2013 Toshio Kuratomi <toshio@fedoraproject.org> - 1.3.1-4 - Fix for CVE 2013-2099 * Thu May 23 2013 Tim Flink <tflink@fedoraproject.org> - 1.3.1-3 - undo python2 executable rename to python-pip. fixes #958377 - fix summary to match upstream * Mon May 6 2013 Kevin Kofler <Kevin@tigcc.ticalc.org> - 1.3.1-2 - Fix main package Summary, it's for Python 2, not 3 (#877401) * Fri Apr 26 2013 Jon Ciesla <limburgher@gmail.com> - 1.3.1-1 - Update to 1.3.1, fix for CVE-2013-1888. * Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Tue Oct 9 2012 Tim Flink <tflink@fedoraproject.org> - 1.2.1-2 - Fixing files for python3-pip * Thu Oct 4 2012 Tim Flink <tflink@fedoraproject.org> - 1.2.1-1 - Update to upstream 1.2.1 - Change binary from pip-python to python-pip (RHBZ#855495) - Add alias from python-pip to pip-python, to be removed at a later date * Tue May 15 2012 Tim Flink <tflink@fedoraproject.org> - 1.1.0-1 - Update to upstream 1.1.0 ------------------------------------------------------------------------------- - References:
[ 1 ] Bug #963260 - CVE-2013-2098 CVE-2013-2099 python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns https://bugzilla.redhat.com/show_bug.cgi?id=963260 ------------------------------------------------------------------------------- -
This update can be installed with the "yum" update program. Use su -c 'yum update python-pip' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ------------------------------------------------------------------------------- - _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-announce
|
|
|
|