[ GLSA 201507-16 ] Portage

[GLSA]

Gentoo Linux Security Advisory

Title: Portage: Man-in-the-middle attack (GLSA 201507-16)
Severity: normal
Exploitable: remote
Date: July 10, 2015
Bug(s): #469888
ID: 201507-16

Synopsis

A vulnerability in Portage's urlopen function could allow a remote
attacker to conduct a man-in-the-middle attack.


Background

Portage is the package management and distribution system for Gentoo.

Affected Packages

Package: sys-apps/portage
Vulnerable: < 2.1.12.2
Unaffected: >= 2.1.12.2
Architectures: All supported architectures


Description

Portage does not verify X.509 SSL certificates properly if HTTPS is
used.


Impact

A remote attacker can spoof servers and modify binary package lists via
specially crafted certificates.


Workaround

There is no known workaround at this time.

Resolution

All Portage users should upgrade to the latest version: