Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-M2Crypto for openSUSE:Factory
checked in at 2026-10-14 18:33:23
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-M2Crypto (Old)
and /work/SRC/openSUSE:Factory/.python-M2Crypto.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-M2Crypto"
Wed Oct 14 18:33:23 2026 rev:62 rq:1384451 version:0.50.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-M2Crypto/python-M2Crypto.changes
2026-10-06 19:13:27.634058516 +0200
+++
/work/SRC/openSUSE:Factory/.python-M2Crypto.new.3698736/python-M2Crypto.changes
2026-10-14 18:33:38.617122333 +0200
@@ -1,0 +2,17 @@
+Mon Oct 12 20:35:30 UTC 2026 - Matej Cepl <[email protected]>
+
+- Update to 0.51.0:
+ - CVE-2026-109087: hostname verification vulnerable
+ to subjectAltName injection (bsc#1285047,
+ https://codefloe.com/mcepl/m2crypto/issues/409) SSL.Checker
+ no longer splits the printed subjectAltName on commas. A
+ URI, email or otherName SAN containing ",DNS:<host>" was
+ accepted as a DNS identity for <host>. Hostname checks now
+ use OpenSSL's X509_check_host()/X509_check_ip_asc() on the
+ decoded GeneralNames.
+ - Fix regex injection in TLS hostname verification (no CVE,
+ kindly reported by eGkritsis)
+ - adding the project to the Anthropic OSS Security Scanner
+ (https://github.com/anthropics/oss-scanner/pull/479)
+
+-------------------------------------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
