Red Hat Security AdvisoryRHSA-2009:1452
neon security update
Released 2009-09-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) neon-0.25.5-10.el5_4.1, neon-0.25.5-10.el5_4.1.i386, neon-0.25.5-10.el5_4.1.ia64 +5
- Red Hat Enterprise Linux AS version 4 neon-0.24.7-4.el4_8.2, neon-0.24.7-4.el4_8.2.i386, neon-0.24.7-4.el4_8.2.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) neon-0.25.5-10.el5_4.1, neon-0.25.5-10.el5_4.1.i386
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) neon-0.25.5-10.el5_4.1, neon-devel-0.25.5-10.el5_4.1, neon-devel-0.25.5-10.el5_4.1.i386
- Red Hat Enterprise Linux Desktop version 4 neon-0.24.7-4.el4_8.2, neon-0.24.7-4.el4_8.2.i386, neon-devel-0.24.7-4.el4_8.2 +1
- Red Hat Enterprise Linux ES version 4 neon-0.24.7-4.el4_8.2, neon-0.24.7-4.el4_8.2.i386, neon-0.24.7-4.el4_8.2.ia64 +3
- Red Hat Enterprise Linux WS version 4 neon-0.24.7-4.el4_8.2, neon-0.24.7-4.el4_8.2.i386, neon-0.24.7-4.el4_8.2.ia64 +3
Fixes 2 records
Priority LOW 31
neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML doc…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.08437 · Published 2009-08-21 · Partial fix CWE-399
Priority LOW 29
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.01493 · Published 2009-08-21 · Fixed CWE-326
