Bug 812068 - python: SSL CBC IV vulnerability (CVE-2011-3389, BEAST)
python: SSL CBC IV vulnerability (CVE-2011-3389, BEAST)
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120127,repor...
: Security
Depends On: 1008815
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-12 12:57 EDT by Tomas Hoger
Modified: 2016-11-08 11:29 EST (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-29 08:59:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2012-04-12 12:57:46 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3389 to the following vulnerability:

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. 

OpenSSL upstream provided an workaround to address the CVE-2011-3389 flaw, but as it had interoperability issues with some SSL/TLS implementations, an option flag SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS was added to disable the workaround and it was also included in the SSL_OP_ALL option commonly set by applications using OpenSSL:
  http://www.openssl.org/~bodo/tls-cbc.txt

SSL_OP_ALL was also used by the Python _ssl module.  Upstream has decided to explicitly exclude SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS from options being set for SSL connection and hence enable the workaround.
  http://bugs.python.org/issue13885

The change was done upstream in versions: 2.6.8, 2.7.3, 3.1.5, and 3.2.3
  http://www.python.org/download/releases/2.6.8/
  http://www.python.org/download/releases/2.7.3/
  http://www.python.org/download/releases/3.1.5/
  http://www.python.org/download/releases/3.2.3/
Comment 1 Fedora Update System 2012-05-02 00:49:53 EDT
python-2.7.3-3.fc17, python-docs-2.7.3-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 2 Fedora Update System 2012-05-03 03:28:31 EDT
python3-3.2.3-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2012-05-05 21:26:31 EDT
python-2.7.3-1.fc16, python-docs-2.7.3-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2012-05-07 00:16:51 EDT
python3-3.2.3-5.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2012-05-07 18:10:04 EDT
python26-2.6.8-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-06-19 10:53:30 EDT
python3-3.2.3-2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Vincent Danen 2013-09-18 01:47:06 EDT
A patch for cpython is here:

http://hg.python.org/cpython/rev/d1390175fdc6

Note You need to log in before you can comment on or make changes to this bug.