Christian Heimes

O módulo `ssl` não desconfia de certificados intermediários comprovadamente comprometidos. Para resolver isso, foi implementada uma denylist de certificados comprometidos para garantir que esses certificados sejam automaticamente rejeitados, independentemente da configuração da política `SSLContext`, mesmo quando a revogação de certificados não estiver configurada.

The issue is related to the mishandling of certain cases where the desired set of CA certificates is different from the OS store of CA certificates, resulting in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to the use of the `ssl context`, `ca certs`, or `ca certs dir` argument. The vulnerability may allow a remote attacker to establish an SSL connection despite certificate verification errors.

The issue concerns improper restriction of access to the infopipe based on the `allowed uids` configuration parameter. This could lead to the disclosure of sensitive information stored in the user directory to local attackers.

The issue arises from the `int x509 param set hosts` function in `lib/libcrypto/x509/x509 vpm.c`, which fails to handle a specific special case of a zero name length. This oversight leads to the silent omission of hostname verification, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

The issue makes it easier for remote attackers to guess the value of the pseudo-random number generator (PRNG) via unspecified vectors, due to the PRNG not being reseeded.

The issue allows remote attackers to obtain random numbers and derive the PRNG state for password resets. This could potentially be used to gain unauthorized access.

The issue allows remote attackers to obtain passwords due to timing discrepancies in password validation. This is related to the AccessControl/AuthEncoding.py component in Zope.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a crafted HTTP request. This is due to a problem in the gzip decode function within the xmlrpc client library.

The issue arises from the improper handling of a `0` character in a domain name within the Subject Alternative Name field of an X.509 certificate by the X509Extension in pyOpenSSL. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.