PT-2014-2550 · Gentoo · Gentoo Portage

Jason A. Donenfeld · Publicado 2014-09-29 · Atualizado 2022-05-17 · CVE-2013-2100

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gentoo Portage version 2.1.12

Description The issue concerns the urlopen function in Gentoo Portage, which fails to verify X.509 certificates from SSL servers when using HTTPS. This allows man-in-the-middle attackers to spoof servers and modify binary package lists by using a crafted certificate.

Recommendations For Gentoo Portage version 2.1.12, consider disabling the urlopen function until a patch is available, or apply configuration changes to enforce certificate verification for HTTPS connections.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-2100

GHSA-8823-XPHR-QW9V

PYSEC-2014-115

Produtos afetados

Gentoo Portage

Referências · 12

• 🔥 http://openwall.com/lists/oss-security/2013/05/15/5 · Exploit
• https://github.com/gentoo/portage · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/portage/PYSEC-2014-115.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2100 · Nota de Segurança
• https://github.com/advisories/GHSA-8823-xphr-qw9v · Nota
• https://security.gentoo.org/glsa/201507-16 · Aviso do Fabricante
• https://bugs.gentoo.org/show_bug.cgi?id=469888 · Correção
• https://osv.dev/vulnerability/GHSA-8823-xphr-qw9v · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/05/16/3 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84315 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-115 · Aviso do Fabricante
• http://securityfocus.com/bid/59878 · Nota