[Secure-testing-team] Bug#684511: libpython2.6: CVE-2011-3389 - SSL man-in-the-middle attack

[aw at linux.de]

Package: libpython2.6
Version: 2.6.6-8
Severity: important
Tags: security, squeeze
Justification: user security hole


CVE-2011-3389 is fixed in unstable/testing, but not in stable, yet:

The SSL protocol [...] encrypts data by using CBC mode with chained
initialization vectors, which allows man-in-the-middle attackers to obtain
plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an
HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5
WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient
API, aka a "BEAST" attack.

cu

AW

-- System Information:
Debian Release: 6.0.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable'), (50, 'proposed-updates')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-686 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=de_DE (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/dash

Versions of packages libpython2.6 depends on:
ii  libc6                  2.11.3-4          Embedded GNU C Library: Shared lib
ii  libssl0.9.8            0.9.8o-4squeeze13 SSL shared libraries
ii  python2.6              2.6.6-8           An interactive high-level object-o
ii  zlib1g                 1:1.2.3.4.dfsg-3  compression library - runtime

libpython2.6 recommends no packages.

libpython2.6 suggests no packages.

-- no debconf information