~ / search / GHSA-8823-xphr-qw9v

GHSA-8823-xphr-qw9v

Gentoo Portage does not verify X.509 certificates from SSL servers

Source: GitHub Advisory Database (reviewed) High CVE-2013-2100

Packages

EcosystemPackageAffectedFixed in
PyPI portage < 2.1.12.2 2.1.12.2

Details

As written in the advisory (Markdown source, shown as plain text).

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

References

External links from the advisory. They lead to third-party sites.