[eGenix.com] ANN: eGenix pyOpenSSL Distribution 0.13.7

[egenix-announcements at egenix.com]

________________________________________________________________________
ANNOUNCING

                   eGenix.com pyOpenSSL Distribution

                             Version 0.13.7


             An easy-to-install and easy-to-use distribution
             of the pyOpenSSL Python interface for OpenSSL -
            available for Windows, Mac OS X and Unix platforms


This announcement is also available on our web-site for online reading:
http://www.egenix.com/company/news/eGenix-pyOpenSSL-Distribution-0.13.7.html

________________________________________________________________________
INTRODUCTION

The eGenix.com pyOpenSSL Distribution includes everything you need to
get started with SSL in Python.

It comes with an easy-to-use installer that includes the most recent
OpenSSL library versions in pre-compiled form, making your application
independent of OS provided OpenSSL libraries:

    http://www.egenix.com/products/python/pyOpenSSL/

pyOpenSSL is an open-source Python add-on that allows writing SSL/TLS-
aware network applications as well as certificate management tools:

    https://launchpad.net/pyopenssl/

OpenSSL is an open-source implementation of the SSL/TLS protocol:

    http://www.openssl.org/

________________________________________________________________________
NEWS

This new release of the eGenix.com pyOpenSSL Distribution updates the
included OpenSSL version to the latest OpenSSL 1.0.1h version and adds
a few more context options:

New in OpenSSL
--------------

 * Updated included OpenSSL libraries from OpenSSL 1.0.1j to
   1.0.1k. See https://www.openssl.org/news/secadv_20150108.txt for a
   complete list of changes. The following fixes are relevant for
   pyOpenSSL applications:

   - CVE-2014-8275: OpenSSL accepts several non-DER-variations of
     certificate signature algorithm and signature encodings. OpenSSL
     also does not enforce a match between the signature algorithm
     between the signed and unsigned portions of the certificate. By
     modifying the contents of the signature algorithm or the encoding
     of the signature, it is possible to change the certificate's
     fingerprint.

   - CVE-2014-3572: An OpenSSL client will accept a handshake using an
     ephemeral ECDH ciphersuite using an ECDSA certificate if the
     server key exchange message is omitted. This effectively removes
     forward secrecy from the ciphersuite.

   - CVE-2015-0204: An OpenSSL client will accept the use of an RSA
     temporary key in a non-export RSA key exchange ciphersuite. A
     server could present a weak temporary key and downgrade the
     security of the session.

   - CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect
     results on some platforms, including x86_64. This bug occurs at
     random with a very low probability, and is not known to be
     exploitable in any way, though its exact impact is difficult to
     determine.

   - CVE-2015-0205: An OpenSSL server will accept a DH certificate for
     client authentication without the certificate verify
     message. This effectively allows a client to authenticate without
     the use of a private key. This only affects servers which trust a
     client certificate authority which issues certificates containing
     DH keys: these are extremely rare and hardly ever encountered.

Please see the product changelog for the full set of changes:

   http://www.egenix.com/products/python/pyOpenSSL/changelog.html

pyOpenSSL / OpenSSL Binaries Included
-------------------------------------

In addition to providing sources, we make binaries available that
include both pyOpenSSL and the necessary OpenSSL libraries for all
supported platforms: Windows x86 and x64, Linux x86 and x64, Mac OS X
PPC, x86 and x64.

We've also added egg-file distribution versions of our eGenix.com
pyOpenSSL Distribution for Windows, Linux and Mac OS X to the
available download options. These make setups using e.g. zc.buildout
and other egg-file based installers a lot easier.

________________________________________________________________________
DOWNLOADS

The download archives and instructions for installing the package can
be found at:

    http://www.egenix.com/products/python/pyOpenSSL/

________________________________________________________________________
UPGRADING

Before installing this version of pyOpenSSL, please make sure that
you uninstall any previously installed pyOpenSSL version. Otherwise,
you could end up not using the included OpenSSL libs.

_______________________________________________________________________
SUPPORT

Commercial support for these packages is available from eGenix.com.
Please see

    http://www.egenix.com/services/support/

for details about our support offerings.

________________________________________________________________________
MORE INFORMATION

For more information about the eGenix pyOpenSSL Distribution, licensing
and download instructions, please visit our web-site or write to
sales at egenix.com.

Enjoy,
-- 
Marc-Andre Lemburg
eGenix.com

Professional Python Services directly from the Source  (#1, Jan 09 2015)
>>> Python Projects, Coaching and Consulting ...  http://www.egenix.com/
>>> mxODBC Plone/Zope Database Adapter ...       http://zope.egenix.com/
>>> mxODBC, mxDateTime, mxTextTools ...        http://python.egenix.com/
________________________________________________________________________

::::: Try our mxODBC.Connect Python Database Interface for free ! ::::::

   eGenix.com Software, Skills and Services GmbH  Pastor-Loeh-Str.48
    D-40764 Langenfeld, Germany. CEO Dipl.-Math. Marc-Andre Lemburg
           Registered at Amtsgericht Duesseldorf: HRB 46611
               http://www.egenix.com/company/contact/