========================================================================== Ubuntu Security Notice USN-1948-1 September 09, 2013 python-httplib2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. Software Description: - python-httplib2: comprehensive HTTP client library written for Python Details: It was discovered that httplib2 only validated SSL certificates on the first request to a connection, and didn't report validation failures on subsequent requests. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could possibly be exploited in certain scenarios to alter or compromise confidential information in applications that used the httplib2 library. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: python-httplib2 0.7.7-1ubuntu0.1 Ubuntu 12.10: python-httplib2 0.7.4-2ubuntu0.1 Ubuntu 12.04 LTS: python-httplib2 0.7.2-1ubuntu2.1 Ubuntu 10.04 LTS: python-httplib2 0.7.2-1ubuntu2~0.10.04.2 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1948-1 CVE-2013-2037 Package Information: https://launchpad.net/ubuntu/+source/python-httplib2/0.7.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/python-httplib2/0.7.4-2ubuntu0.1 https://launchpad.net/ubuntu/+source/python-httplib2/0.7.2-1ubuntu2.1 https://launchpad.net/ubuntu/+source/python-httplib2/0.7.2-1ubuntu2~0.10.04.2
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.