-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:003 http://www.mandriva.com/security/ _______________________________________________________________________ Package : rootcerts Date : January 9, 2013 Affected: 2011. _______________________________________________________________________ Problem Description: Google reported to Mozilla that TURKTRUST, a certificate authority in Mozillas root program, had mis-issued two intermediate certificates to customers. The issue was not specific to Firefox but there was evidence that one of the certificates was used for man-in-the-middle (MITM) traffic management of domain names that the customer did not legitimately own or control. This issue was resolved by revoking the trust for these specific mis-issued certificates (CVE-2013-0743). The rootcerts package has been upgraded to address this flaw and the Mozilla NSS package has been rebuilt to pickup the changes. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0743 http://www.mozilla.org/security/announce/2013/mfsa2013-20.html _______________________________________________________________________ Updated Packages: Mandriva Linux 2011: 196c985cb9a0c43026b517740bc84964 2011/i586/libnss3-3.14-0.2-mdv2011.0.i586.rpm 9e8211d7552f2f4c29e5100c2e22666d 2011/i586/libnss-devel-3.14-0.2-mdv2011.0.i586.rpm 73cac4a13ff3263762bd6e6958fd9ee5 2011/i586/libnss-static-devel-3.14-0.2-mdv2011.0.i586.rpm 22b7d7c8c8cb651dc8f029ea4a21df62 2011/i586/nss-3.14-0.2-mdv2011.0.i586.rpm d4104fdc7fd808e2065cf11c9579881e 2011/i586/rootcerts-20121229.00-1-mdv2011.0.i586.rpm 8892d8d81576147685b6c6c2f27a3cc1 2011/i586/rootcerts-java-20121229.00-1-mdv2011.0.i586.rpm 2a1932633742f095598acbc71a65e07e 2011/SRPMS/nss-3.14-0.2.src.rpm 988252152ffcacd263670b84a70a4eb3 2011/SRPMS/rootcerts-20121229.00-1.src.rpm Mandriva Linux 2011/X86_64: cceba1cdc46199e9acf7702784637321 2011/x86_64/lib64nss3-3.14-0.2-mdv2011.0.x86_64.rpm 6cea0e30ea682bf7a067486b17205107 2011/x86_64/lib64nss-devel-3.14-0.2-mdv2011.0.x86_64.rpm ba17542fa03c2e19ad05f49fd7be52bc 2011/x86_64/lib64nss-static-devel-3.14-0.2-mdv2011.0.x86_64.rpm d89adc7b2d715f9979e30b40881c7f6a 2011/x86_64/nss-3.14-0.2-mdv2011.0.x86_64.rpm 6f42e1222e7670a942e887f6e1dd5a00 2011/x86_64/rootcerts-20121229.00-1-mdv2011.0.x86_64.rpm da48a7a352314122da074e9831d6a8ac 2011/x86_64/rootcerts-java-20121229.00-1-mdv2011.0.x86_64.rpm 2a1932633742f095598acbc71a65e07e 2011/SRPMS/nss-3.14-0.2.src.rpm 988252152ffcacd263670b84a70a4eb3 2011/SRPMS/rootcerts-20121229.00-1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFQ7YQ2mqjQ0CJFipgRAhEXAKCO40WVKjgaPnLl2Miwavd8dbpWxwCgv5jg bOqBKm41lnWZcvt9di0Tp+8= =nfc8 -----END PGP SIGNATURE-----
