Bug 812068 - python: SSL CBC IV vulnerability (CVE-2011-3389, BEAST)
Summary: python: SSL CBC IV vulnerability (CVE-2011-3389, BEAST)
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1008815
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-12 16:57 UTC by Tomas Hoger
Modified: 2019-09-29 12:52 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-07-29 12:59:48 UTC
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2012-04-12 16:57:46 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3389 to the following vulnerability:

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. 

OpenSSL upstream provided an workaround to address the CVE-2011-3389 flaw, but as it had interoperability issues with some SSL/TLS implementations, an option flag SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was added to disable the workaround and it was also included in the SSL_OP_ALL option commonly set by applications using OpenSSL:
  http://www.openssl.org/~bodo/tls-cbc.txt

SSL_OP_ALL was also used by the Python _ssl module.  Upstream has decided to explicitly exclude SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS from options being set for SSL connection and hence enable the workaround.
  http://bugs.python.org/issue13885

The change was done upstream in versions: 2.6.8, 2.7.3, 3.1.5, and 3.2.3
  http://www.python.org/download/releases/2.6.8/
  http://www.python.org/download/releases/2.7.3/
  http://www.python.org/download/releases/3.1.5/
  http://www.python.org/download/releases/3.2.3/

Comment 1 Fedora Update System 2012-05-02 04:49:53 UTC
python-2.7.3-3.fc17, python-docs-2.7.3-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 2 Fedora Update System 2012-05-03 07:28:31 UTC
python3-3.2.3-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2012-05-06 01:26:31 UTC
python-2.7.3-1.fc16, python-docs-2.7.3-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2012-05-07 04:16:51 UTC
python3-3.2.3-5.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2012-05-07 22:10:04 UTC
python26-2.6.8-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2012-06-19 14:53:30 UTC
python3-3.2.3-2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Vincent Danen 2013-09-18 05:47:06 UTC
A patch for cpython is here:

http://hg.python.org/cpython/rev/d1390175fdc6


Note You need to log in before you can comment on or make changes to this bug.