Date: Wed, 22 May 2013 11:46:39 -0400 (EDT) From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org>, Apostolis Bessas <mpessas@...nsifex.com>, Ilias Vrachnis <vid@...nsifex.com>, Radek Vokal <rvokal@...hat.com>, Florian Weimer <fweimer@...hat.com> Subject: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) Hello Steve, vendors, It was found that Transifex command-line client, a command line tool for Transifex translation management, did not perform X.509 certificate verification when using secured SSL connection. A man-in-the-middle attacker could use this flaw to spoof a Transifex server via an arbitrary certificate. The CVE identifier of CVE-2013-2073 has been allocated to this issue. Acknowledgements: This issue was discovered by Florian Weimer of the Red Hat Product Security Team. Red Hat would like to thank Apostolis Bessas and Ilias Vrachnis of Transifex for prompt replies and patches. Fixed in: transifex-client v0.9: https://pypi.python.org/pypi/transifex-client/0.9 http://blog.transifex.com/post/51072109836/new-version-of-the-transifex-client-has-been-released Upstream patches are as follows:  https://github.com/transifex/transifex-client/commit/e24ea954373874962f22f63a7311d04d6ff56d84  https://github.com/transifex/transifex-client/commit/f237dd7d3f4f08be7160f32eb99edafe2769aad1  https://github.com/transifex/transifex-client/commit/5246f188b0abcc1a4c20894fcab88f7a6cd6cfd9  https://github.com/transifex/transifex-client/commit/ad29a9dbe869e0c7d861826a82c9ce2f022face4 Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ