[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in
From:       Jan Lieskovsky <jlieskov () redhat ! com>
Date:       2013-05-22 15:46:39
Message-ID: 1970861107.5816983.1369237599522.JavaMail.root () redhat ! com
[Download RAW message or body]

Hello Steve, vendors,

  It was found that Transifex command-line client, a command line tool for Transifex
translation management, did not perform X.509 certificate verification when using
secured SSL connection. A man-in-the-middle attacker could use this flaw to spoof
a Transifex server via an arbitrary certificate.

The CVE identifier of CVE-2013-2073 has been allocated to this issue.

Acknowledgements:
  This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

  Red Hat would like to thank Apostolis Bessas and Ilias Vrachnis of Transifex
  for prompt replies and patches.

Fixed in: transifex-client v0.9:
            https://pypi.python.org/pypi/transifex-client/0.9
            http://blog.transifex.com/post/51072109836/new-version-of-the-transifex-client-has-been-released

Upstream patches are as follows:
[1] https://github.com/transifex/transifex-client/commit/e24ea954373874962f22f63a7311d04d6ff56d84
[2] https://github.com/transifex/transifex-client/commit/f237dd7d3f4f08be7160f32eb99edafe2769aad1
[3] https://github.com/transifex/transifex-client/commit/5246f188b0abcc1a4c20894fcab88f7a6cd6cfd9
[4] https://github.com/transifex/transifex-client/commit/ad29a9dbe869e0c7d861826a82c9ce2f022face4

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
[prev in list] [next in list] [prev in thread] [next in thread]