Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
More on Refuses
Other advisories
- Not ratedosv:CLEANSTART-2026-HS02762undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
- Not ratedosv:CLEANSTART-2026-WF83239undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
- Not ratedosv:CLEANSTART-2026-VO74481undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
- Not ratedosv:ECHO-eeb1-df32-dbaaThe vulnerable code postdates this version. The Python >= 3.12 no-op host-name matcher (sslcompat returning True when ssl.match_hostname is missing) was introduced by 23e0e5ce (first released in 0.22.0) and is not an ancestor of v0.19.0. On trixie's Python 3.13 this version's sslcompat falls back to legacy_validate_callback, which compares the certificate commonName and raises on a mismatch; TSSLSocket uses PROTOCOL_SSLv23 (the PROTOCOL_TLS alias) with check_hostname off, so that callback is the check that runs. Verified with real handshakes against the built lib on Python 3.13.5: a certificate for "localhost" offered to a client expecting "wrong.example" is refused with the default ssl_version, with an explicit PROTOCOL_TLS (the upstream regression case) and with PROTOCOL_TLSv1_2, and TSSLServerSocket refuses a trusted client certificate issued for another identity. The same script against upstream v0.24.0's lib accepts both explicit-ssl_version mismatches, as the CVE describes. The fix d6782a87 restores a real matcher in sslcompat (code this version never lost) and turns on check_hostname for explicit-ssl_version contexts, which 0.19.0 does not need because open() always runs _validate_callback. Same reasoning as CVE-2026-66053.
- Not ratedosv:CLEANSTART-2026-XL00241undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header
Other news entries
- Swiss train maker tells ransomware crooks to get off at the next stopNewsThe Register — Security
- New Index Tracks Material Breaches — And Refuses to Add Up the LossesNewsSecurityWeek
- Windows 10 refuses to die, and the security bill is coming dueNewsThe Register — Security
- Cybercriminals exploit India’s tax filing season with a dual-malware campaignNewsCSO Online
- GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in CodeNewsThe Hacker News
Source: https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html
ID