[Secure-testing-team] Bug#557326: CVE-2009-3941

[Giuseppe Iuculano]

Package: mpop
Version: 1.0.5-1etch1
Severity: serious
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for mpop.

CVE-2009-3941[0]:
| Martin Lambers mpop before 1.0.19, when OpenSSL is used, does not
| properly handle a '\0' character in a domain name in the (1) subject's
| Common Name or (2) Subject Alternative Name field of an X.509
| certificate, which allows man-in-the-middle attackers to spoof
| arbitrary SSL servers via a crafted certificate issued by a legitimate
| Certification Authority, a related issue to CVE-2009-2408.


This is already fixed in unstable, please coordinate with the
security team (team at security.debian.org) to prepare packages for
the stable and oldstable releases.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3941
    http://security-tracker.debian.org/tracker/CVE-2009-3941

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAksH29wACgkQNxpp46476ari+ACfZeKuKSBepACdhjiSu9YPLO6t
f8MAn1ypMVXgeHWxXW61zvZuxsHI3RnD
=GjeA
-----END PGP SIGNATURE-----