Ubuntu has issued this advisory on February 27: http://www.ubuntu.com/usn/usn-1375-1/ Ubuntu fixed it by just upgrading to the newest version. Cauldron is not vulnerable.
CC: (none) => makowski.mageia
ping ?
Assignee: bugsquad => makowski.mageia
python-httplib2-0.7.2-1.mga1 is in 1/core/updates_testing sorry for the delay
Assigning to QA. Note to QA: the mgarepo tool used by packagers uses this, so it would be a good thing to test it with. I think it just uses it for uploading binary files to the binrepo. I guess some packagers should help QA with this. Advisory: ======================== Updated python-httplib2 package fixes security vulnerability: The httplib2 Python library earlier than version 0.7.0 did not perform any server certificate validation when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information in applications that used the httplib2 library. References: http://www.ubuntu.com/usn/usn-1375-1/ ======================== Updated packages in core/updates_testing: ======================== python-httplib2-0.7.2-1.mga1 from python-httplib2-0.7.2-1.mga1.src.rpm
Assignee: makowski.mageia => qa-bugs
Well, I'm a packager, and I just so happened to need to upload something to the binrepo, so I just tested it, and it worked! I was testing from i586, but I don't believe it should matter, as it's a noarch package. I believe this can be validated. I'll let the QA team confirm this first. Thanks Philippe.
Based on comment 4, I'll go ahead and validate this update. Could someone from the sysadmin team push the srpm python-httplib2-0.7.2-1.mga1.src.rpm from Core Updates Testing to Core Updates. Advisory: Updated python-httplib2 package fixes security vulnerability: The httplib2 Python library earlier than version 0.7.0 did not perform any server certificate validation when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information in applications that used the httplib2 library. References: http://www.ubuntu.com/usn/usn-1375-1/ https://bugs.mageia.org/show_bug.cgi?id=5256
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugs
Update pushed
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED