[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20141107005330.BF36C42E020@smtpvbsrv1.mitre.org>
Date: Thu, 6 Nov 2014 19:53:30 -0500 (EST)
From: cve-assign@...re.org
To: graffatcolmingov@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request for requests-kerberos
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://github.com/requests/requests-kerberos/pull/36
> https://github.com/mkomitee/requests-kerberos/commit/9c1e08cc17bb6950455a85d33d391ecd2bce6eb6
> https://pypi.python.org/pypi/requests-kerberos
> A fix was merged and released today for the package which performs
> kerberos authentication when using python-requests. Prior to this,
> every version of the package did not properly handle mutual
> authentication which means that the client did not verify that the
> user was communicating with a trusted server. The version which
> contains the fix is 0.6 and all prior versions are considered
> vulnerable.
> This bug, however, prevented the mutual authentication code from being
> executed, so it's possible that users think they're talking to a
> trusted server, but they're not.
> requests_kerberos/kerberos_.py
> Make certain that responses always pass through handle_other() to provide mutual
> authentication before returning them to the user.
> 0.6: 2014-11-04
> Handle mutual authentication (see pull request 36)
Use CVE-2014-8650.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUXBeLAAoJEKllVAevmvmssi4IAIuPRLXq+cRuy9kVNZMey5hd
GVJKAZA4ZBqPHa147iuEpHLiNQx/aKTCTWoXZBeqnFdZKZFi/Uq5BLws4nWKDhfj
JW5VCfUR6nf0uiglbmQwFX9eswGlLo/73V8NWReymrv9ENc709BNcSVErw76qElh
p6zBrdRsGqIG1MfeKF8xt0Gn63e55k/qE4t4TeGybeQyLxtGfF+Potyxx9RYtlIr
MrrXJIIQKry8DcRTHWfuEx1nJ65dOXJETnEBiAQTaQJ9y3NPEylbL6g83ykRGENl
QWYZNI/hZ6ZVg8Wub6h2YHp52UqLz7I/rwJN47N3uNebElbgLqNwz1BOHS+WKdc=
=5P3v
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
