Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bzr: does not strip bzr+ssh SSH options (CVE-2017-14176)

  - Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and     earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python     versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard     characters in the common name in a certificate. (CVE-2013-2099)

  - The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not     properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via     a crafted certificate. (CVE-2013-7440)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1166 advisory.

  - python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns     (CVE-2013-2099)

  - python: wildcard matching rules do not follow RFC 6125 (CVE-2013-7440)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2013-2099

Bazaar bundles SSL certificate checking code from Python, which had a bug that could cause a denial of service via resource consumption through multiple wildcards in certificate hostnames.

CVE-2017-14176

Adam Collard found that host names in 'bzr+ssh' URLs were not parsed correctly by Bazaar, allowing remote attackers to run arbitrary code by tricking a user into a maliciously crafted URL.

For Debian 7 'Wheezy', these problems have been fixed in version 2.6.0~bzr6526-1+deb7u1.

We recommend that you upgrade your bzr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2013-2099, CVE-2013-7440

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service flaw was found in the way Python's SSL module implementation performed matching of certain certificate names. A remote attacker able to obtain a valid certificate that contained multiple wildcard characters could use this flaw to issue a request to validate such a certificate, resulting in excessive consumption of CPU.

Updated cloud-init packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Common for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install ssh keys and to let the user run various scripts.

A denial of service flaw was found in the way Python's SSL module implementation performed matching of certain certificate names. A remote attacker able to obtain a valid certificate that contained multiple wildcard characters could use this flaw to issue a request to validate such a certificate, resulting in excessive consumption of CPU. (CVE-2013-2099)

This issue was discovered by Florian Weimer of Red Hat Product Security.

The cloud-init packages have been upgraded to upstream version 0.7.5, which provides a number of bug fixes and enhancements over the previous version. (BZ#1111709, BZ#1119334)

All cloud-init users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

- Add patch to fix CVE-2013-2098 CVE-2013-2099 (bug     #96627)

    - Drop requires python-simplejson, not needed for modern       python

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This python3 update fixes the following security and non security issues :

  - CGIHTTPServer filedisclosure and directory traversal     through URL-encoded characters (CVE-2014-4650,     bnc#885882)

  - DoS on ssl.match_hostname via a crafted certificate with     too many wildcards (CVE-2013-2099, bnc#886001)

  - fix import_failed hook file names

The remote host is affected by the vulnerability described in GLSA-201401-04 (Python: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Python. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition or       perform a man-in-the-middle attack to disclose sensitive information.
  Workaround :

    There is no known workaround at this time.

Florian Weimer discovered that Python incorrectly handled matching multiple wildcards in ssl certificate hostnames. An attacker could exploit this to cause Python to consume resources, resulting in a denial of service. (CVE-2013-2099)

Ryan Sleevi discovered that Python did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2013-4238).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer discovered that Python incorrectly handled matching multiple wildcards in ssl certificate hostnames. An attacker could exploit this to cause Python to consume resources, resulting in a denial of service. This issue only affected Ubuntu 13.04.
(CVE-2013-2099)

Ryan Sleevi discovered that Python did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2013-4238).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated bzr packages fix security vulnerabilities :

A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificate's name in the case it contained many '*' wildcard characters. A remote attacker, able to obtain valid certificate with its name containing a lot of '*' wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Python's ssl.match_hostname() functionality (CVE-2013-2099).

Fix potential DOS with specially crafted malicious SSL certs. Backing out rename of pip binary to fix #958377 and updating package summary to match upstream's description. Backing out rename of pip binary to fix #958377 and updating package summary to match upstream's description.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Enhancements :

  - upstream now ships an experimental OCaml front-end, this     is not yet enabled

    - Add fish-shell command completion

    - Allow relative files in <archive> and <file> for local       feeds. This makes it easy to test feeds before passing       them to 0repo.

Bug fixes :

  - Better handling of default=' in <environment> bindings.
    This now specifies that the default should be ',     overriding any system default.

    - Fixed --refresh with 'download' and 'run' for apps.

    - Updated ssl_match_hostname based on latest bug-fixes.
      This fix is intended to fix a denial-of-service       attack, which doesn't really matter to 0install, but       we might as well have the latest version.
      CVE-2013-2099

    - Better error when the <rename> source does not exist.

    - Allow selecting local archives even in offline mode.

    - Support the use of the system store with recipes. This       is especially important now that we treat all       downloads as recipes!

    - Removed old zeroinstall-add.desktop file.

Changes for APIs we depend on

  - Cope with more PyGObject API changes. Based on patch in     http://twistedmatrix.com/trac/ticket/6369

  - Keep gobject and glib separate. Sometimes we need GLib,     sometimes we need GObject.

    - Updates to avoid PyGIDeprecationWarning.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fixes CVE-2013-2099, maliciously crafted SSL certificate     can cause a denial of service.

    - Builds the C extensions from the Cython source instead       of the pregenerated C files.

    - Build without strict-aliasing on Fedora versions which       have a bug in the python distutils module.

    - Install the localization files

    - (F17-only) Update from upstream 2.5.0 to 2.5.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199254	RHEL 7 : bzr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
193823	RHEL 6 / 7 : python27 (RHSA-2016:1166)	Nessus	Red Hat Local Security Checks	medium
103429	Debian DLA-1107-1 : bzr security update	Nessus	Debian Local Security Checks	high
89544	Fedora 22 : python-pymongo-2.5.2-8.fc22 (2016-52b294538d)	Nessus	Fedora Local Security Checks	medium
89540	Fedora 23 : python-pymongo-2.5.2-8.fc23 (2016-50abc3e885)	Nessus	Fedora Local Security Checks	medium
83272	Amazon Linux AMI : python-tornado (ALAS-2015-521)	Nessus	Amazon Linux Local Security Checks	medium
80506	RHEL 6 : cloud-init (RHSA-2015:0042)	Nessus	Red Hat Local Security Checks	medium
80134	Fedora 19 : python-tornado-2.2.1-7.fc19 (2014-16477)	Nessus	Fedora Local Security Checks	medium
80061	Fedora 20 : python-tornado-2.2.1-7.fc20 (2014-16390)	Nessus	Fedora Local Security Checks	medium
77431	openSUSE Security Update : python3 (openSUSE-SU-2014:1070-1)	Nessus	SuSE Local Security Checks	critical
71811	GLSA-201401-04 : Python: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
70269	Ubuntu 12.10 / 13.04 : python3.3 vulnerabilities (USN-1985-1)	Nessus	Ubuntu Local Security Checks	medium
70268	Ubuntu 12.04 LTS / 12.10 : python3.2 vulnerabilities (USN-1984-1)	Nessus	Ubuntu Local Security Checks	medium
70267	Ubuntu 12.04 LTS / 12.10 / 13.04 : python2.7 vulnerabilities (USN-1983-1)	Nessus	Ubuntu Local Security Checks	medium
69842	Mandriva Linux Security Advisory : bzr (MDVSA-2013:229)	Nessus	Mandriva Local Security Checks	medium
69064	Fedora 19 : python-pip-1.3.1-4.fc19 (2013-13216)	Nessus	Fedora Local Security Checks	medium
69063	Fedora 17 : python-pip-1.3.1-4.fc17 (2013-13213)	Nessus	Fedora Local Security Checks	medium
69062	Fedora 18 : python-pip-1.3.1-4.fc18 (2013-13140)	Nessus	Fedora Local Security Checks	medium
68887	Fedora 17 : zeroinstall-injector-2.3-1.fc17 (2013-12421)	Nessus	Fedora Local Security Checks	medium
68886	Fedora 19 : zeroinstall-injector-2.3-1.fc19 (2013-12414)	Nessus	Fedora Local Security Checks	medium
68884	Fedora 18 : zeroinstall-injector-2.3-1.fc18 (2013-12396)	Nessus	Fedora Local Security Checks	medium
67371	Fedora 17 : bzr-2.5.1-11.fc17 (2013-9628)	Nessus	Fedora Local Security Checks	medium
67369	Fedora 18 : bzr-2.5.1-11.fc18 (2013-9620)	Nessus	Fedora Local Security Checks	medium
67366	Fedora 19 : bzr-2.5.1-11.fc19 (2013-9538)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2099

medium

Tenable Plugins

high

medium

high

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium