Christian Heimes

The `ssl` module fails to distrust known compromised intermediate certificates. To address this, a denylist of compromised certificates has been implemented to ensure that these certificates are automatically rejected, regardless of the `SSLContext` policy configuration, even when certificate revocation is not configured.

The issue is related to the mishandling of certain cases where the desired set of CA certificates is different from the OS store of CA certificates, resulting in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to the use of the `ssl context`, `ca certs`, or `ca certs dir` argument. The vulnerability may allow a remote attacker to establish an SSL connection despite certificate verification errors.

The issue concerns improper restriction of access to the infopipe based on the `allowed uids` configuration parameter. This could lead to the disclosure of sensitive information stored in the user directory to local attackers.

The issue arises from the `int x509 param set hosts` function in `lib/libcrypto/x509/x509 vpm.c`, which fails to handle a specific special case of a zero name length. This oversight leads to the silent omission of hostname verification, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

The issue makes it easier for remote attackers to guess the value of the pseudo-random number generator (PRNG) via unspecified vectors, due to the PRNG not being reseeded.

The issue allows remote attackers to obtain random numbers and derive the PRNG state for password resets. This could potentially be used to gain unauthorized access.

The issue allows remote attackers to obtain passwords due to timing discrepancies in password validation. This is related to the AccessControl/AuthEncoding.py component in Zope.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a crafted HTTP request. This is due to a problem in the gzip decode function within the xmlrpc client library.

The issue arises from the improper handling of a `0` character in a domain name within the Subject Alternative Name field of an X.509 certificate by the X509Extension in pyOpenSSL. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.