This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author lemburg
Recipients Lukasa, alex, benjamin.peterson, christian.heimes, dstufft, giampaolo.rodola, janssen, lemburg, pitrou
Date 2015-11-20.09:12:50
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1448010771.08.0.361627637764.issue25672@psf.upfronthosting.co.za>
In-reply-to
Content
The release buffer mode bugs were fixed in 1.0.0m and 1.0.1h:

https://openssl.org/news/vulnerabilities.html#y2014

CVE-2014-0198 (OpenSSL advisory) 21st April 2014:
    A flaw in the do_ssl3_write function can allow remote attackers to cause a denial of service via a NULL pointer dereference. This flaw only affects OpenSSL 1.0.0 and 1.0.1 where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common.

        Fixed in OpenSSL 1.0.1h (Affected 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
        Fixed in OpenSSL 1.0.0m (Affected 1.0.0l, 1.0.0k, 1.0.0j, 1.0.0i, 1.0.0g, 1.0.0f, 1.0.0e, 1.0.0d, 1.0.0c, 1.0.0b, 1.0.0a, 1.0.0)

CVE-2010-5298 (OpenSSL advisory) 8th April 2014:
    A race condition in the ssl3_read_bytes function can allow remote attackers to inject data across sessions or cause a denial of service. This flaw only affects multithreaded applications using OpenSSL 1.0.0 and 1.0.1, where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common.

        Fixed in OpenSSL 1.0.1h (Affected 1.0.1g, 1.0.1f, 1.0.1e, 1.0.1d, 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
        Fixed in OpenSSL 1.0.0m (Affected 1.0.0l, 1.0.0k, 1.0.0j, 1.0.0i, 1.0.0g, 1.0.0f, 1.0.0e, 1.0.0d, 1.0.0c, 1.0.0b, 1.0.0a, 1.0.0)

PS: OpenSSL normally doesn't issue betas. All their releases are final. The numbering scheme is a bit weird - perhaps they'll change to a more common one with 1.1 (this will have a beta cycle): https://openssl.org/policies/releasestrat.html
History
Date User Action Args
2015-11-20 09:12:51lemburgsetrecipients: + lemburg, janssen, pitrou, giampaolo.rodola, christian.heimes, benjamin.peterson, alex, dstufft, Lukasa
2015-11-20 09:12:51lemburgsetmessageid: <1448010771.08.0.361627637764.issue25672@psf.upfronthosting.co.za>
2015-11-20 09:12:51lemburglinkissue25672 messages
2015-11-20 09:12:50lemburgcreate