python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.

This python-bugzilla update fixes a SSL verification issue.

  - CVE-2013-2191 (bnc#825876) - validate SSL certificates     and hostnames

- Rebased to version 0.9.0

    - bugzilla: modify: add --dependson (Don Zickus)

    - bugzilla: new: add --groups option (Paul Frields)

    - bugzilla: modify: Allow setting nearly every bug       parameter

    - NovellBugzilla implementation removed, can't get it to       work

    - Gracefully handle private bugs (bz #963979)

    - Raise error if python-magic is needed (bz #951572)

    - CVE-2013-2191: Add SSL host and cert validation (bz       #975961, bz #951594)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75076	openSUSE Security Update : python-bugzilla (openSUSE-SU-2013:1154-1)	Nessus	SuSE Local Security Checks	medium
67311	Fedora 18 : python-bugzilla-0.9.0-1.fc18 (2013-11419)	Nessus	Fedora Local Security Checks	medium
67308	Fedora 17 : python-bugzilla-0.9.0-1.fc17 (2013-11397)	Nessus	Fedora Local Security Checks	medium
67306	Fedora 19 : python-bugzilla-0.9.0-1.fc19 (2013-11336)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2191

high

Tenable Plugins

medium

medium

medium

medium