Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3389 to the following vulnerability: The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. OpenSSL upstream provided an workaround to address the CVE-2011-3389 flaw, but as it had interoperability issues with some SSL/TLS implementations, an option flag SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was added to disable the workaround and it was also included in the SSL_OP_ALL option commonly set by applications using OpenSSL: http://www.openssl.org/~bodo/tls-cbc.txt SSL_OP_ALL was also used by the Python _ssl module. Upstream has decided to explicitly exclude SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS from options being set for SSL connection and hence enable the workaround. http://bugs.python.org/issue13885 The change was done upstream in versions: 2.6.8, 2.7.3, 3.1.5, and 3.2.3 http://www.python.org/download/releases/2.6.8/ http://www.python.org/download/releases/2.7.3/ http://www.python.org/download/releases/3.1.5/ http://www.python.org/download/releases/3.2.3/
python-2.7.3-3.fc17, python-docs-2.7.3-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
python3-3.2.3-1.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.
python-2.7.3-1.fc16, python-docs-2.7.3-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
python3-3.2.3-5.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
python26-2.6.8-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
python3-3.2.3-2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
A patch for cpython is here: http://hg.python.org/cpython/rev/d1390175fdc6