Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 20 May 2013 21:21:39 +0200
From: Tomas Hoger <>
To:, Kurt Seifried <>
Cc: Jan Lieskovsky <>,
        "Steven M. Christey"
        Florian Weimer <>,
        Ian Weller
Subject: Re: CVE Request (minor) -- Python 3.2: DoS when
 matching certificate with many '*' wildcard characters {was: 
 CVE Request (minor) --  python-backports-ssl_match_hostname: Denial of
 service when matching certificate with many '*' wildcard characters }

On Wed, 15 May 2013 19:51:38 -0600 Kurt Seifried wrote:

> On 05/15/2013 05:28 AM, Jan Lieskovsky wrote:

> > Replying to myself here. Issue is present in Python 3.2 code too -
> > so the CVE should be allocated for the original (Python 3.2) code,
> > rather than to python-backports-ssl_match_hostname package.


> Please use CVE-2013-2099 for this issue.

There should be no need for two separate CVEs for this issue.
Problematic match_hostname was developed in Python 3.  As its
functionality is needed by Python 2 users, and it is not provided by
the standard library, Python 3 implementation was made available via
different module.  It's the same code, packaged in python (3.x) and
python-backports-ssl_match_hostname packages.  The same CVE should
apply to both.

Given that CVE-2013-2099 was assigned to Python 3 ssl, CVE-2013-2098
seems like the one to reject as dupe.

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.