<div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Apr 23, 2012 at 2:42 PM, <span dir="ltr"><<a href="mailto:martin@v.loewis.de" target="_blank">martin@v.loewis.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I don't see any occurrence of these functions in the various versions of<br>
the _ssl module.<br>
Is Python really affected by this vulnerability?<br>
</blockquote>
<br></div>
We use SSL_CTX_use_certificate_chain_<u></u>file, which ultimately uses<br>
d2i_X509_AUX_fp (I think).<br>
<br>
However, I fail to see how this constitutes are remote vulnerability:<br>
one would have to inject a bad PEM file into an application to trigger<br>
this.<br>
<br>
<a href="http://isc.sans.edu/diary.html?storyid=13018" target="_blank">http://isc.sans.edu/diary.<u></u>html?storyid=13018</a><br>
<br>
claims that this is *not* exploitable over TLS (and I agree); they<br>
warn that it can be exploited e.g. when Apache reads server certificates<br>
from untrusted users. Even in the local case, you need a Python application<br>
running under one account that reads certificate files belonging to<br>
a different (Unix) account to create an exploit.<br>
<br>
So I propose that for the regular bugfix releases, we upgrade the OpenSSL<br>
version, but otherwise take no action at this point.<br></blockquote><div><br></div><div>give that, agreed.</div></div></div>