PT-2013-4915 · Python+3 · Python+3
Murray Mcallister
·
Publicado
2013-08-17
·
Atualizado
2025-11-07
·
CVE-2013-4238
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 2.6 through 3.4
Description
The issue arises from the
ssl.match hostname function in the SSL module, which fails to properly handle a '0' character in a domain name in the Subject Alternative Name field of an X.509 certificate. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.Recommendations
For Python versions 2.6 through 3.4, consider updating to a version where this issue is resolved, as the current version is affected by this issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Python
Red Hat
Suse