File project.diff of Package fetchmail

Overview Repositories Revisions Requests Users Attributes Meta

File project.diff of Package fetchmail (Revision 0890017e88bd78104c8e75ba251a73d5)

Currently displaying revision 0890017e88bd78104c8e75ba251a73d5 , Show latest

--- fetchmail.changes.orig
+++ fetchmail.changes
@@ -1,4 +1,30 @@
 -------------------------------------------------------------------
+Thu Aug  6 11:35:50 UTC 2009 - puzel@novell.com
+
+- update to 6.3.11
+  # SECURITY BUGFIXES
+  * CVE-2009-2666: SSL NUL prefix impersonation attack through NULs in a
+    part of a X.509 certificate's CommonName and subjectAltName fields. These
+    fields use opaque strings with a separate length field, so that the NUL
+    character isn't a special character inside the certificate. Fetchmail, being
+    written in the C language, used to treat these strings as C strings
+    nonetheless, so that the domain comparison would end at the first embedded NUL
+    character, rather than at the real end of the string.
+      Fetchmail will now abort certificate verification as failed if NULs are
+    encountered inside either of these fields regardless of their position, and
+    drop the connection even if --sslcertck is not used, because NUL is not a
+    valid character in legitimate DNS names.
+    See fetchmail-SA-2009-01.txt for details, including a minimal patch.
+  
+  # BUGFIXES
+  * Remove the spurious message "message delimiter found while scanning headers".
+    RFC-5322 syntax states that the delimiter is part of the body, and the body is
+    optional.
+  * Convert all non-printable characters in certificate Subject/Issuer
+    Common Name or Subject Alternative Name fields to ANSI-C hex escapes (\xnn,
+    where nn are hex digits).
+
+-------------------------------------------------------------------
 Fri Jul  3 09:58:22 CEST 2009 - puzel@novell.com
 
 - update to 6.3.10 (final version) 
--- fetchmail.spec.orig
+++ fetchmail.spec
@@ -1,5 +1,5 @@
 #
-# spec file for package fetchmail (Version 6.3.10)
+# spec file for package fetchmail (Version 6.3.11)
 #
 # Copyright (c) 2009 SUSE LINUX Products GmbH, Nuernberg, Germany.
 #
@@ -29,7 +29,7 @@ BuildRequires:  krb5-devel
 License:        GPL v2 or later ;  Other uncritical OpenSource License ;  Public Domain, Freeware
 Group:          Productivity/Networking/Email/Utilities
 AutoReqProv:    on
-Version:        6.3.10
+Version:        6.3.11
 Release:        1
 Source:         %{name}-%{version}.tar.bz2
 Source1:        %{name}.init

Places

File project.diff of Package fetchmail (Revision 0890017e88bd78104c8e75ba251a73d5)

Places