PT-2014-3107 · Python+1 · Pywbem+1

Florian Weimer · Publicado 2014-04-29 · Atualizado 2024-06-15 · CVE-2013-6418

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyWBEM versions 0.7 and earlier

Description The issue allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate, as PyWBEM uses a separate connection to validate X.509 certificates.

Recommendations For PyWBEM versions 0.7 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

AZL-41410

AZL-45129

CVE-2013-6418

GHSA-F9Q5-46QG-74X4

OPENSUSE-SU-2024:11263-1

OPENSUSE-SU-2024:13977-1

PYSEC-2014-93

SUSE-SU-2014_0580-1

Produtos afetados

Pywbem

Suse

Referências · 26

• https://github.com/pypa/advisory-database/tree/main/vulns/pywbem/PYSEC-2014-93.yaml · Nota
• https://github.com/pywbem/pywbem · Nota
• https://github.com/pywbem/pywbem/commit/f7599379b26a685d772b2620a16316130f46c474 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6418 · Nota
• https://suse.com/support/update/announcement/2014/suse-su-20140580-1.html · Aviso do Fabricante
• http://sourceforge.net/p/pywbem/code/627 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:13977-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-45129 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-6418 · Nota de Segurança
• http://sourceforge.net/p/pywbem/mailman/message/31757312 · Nota
• http://securityfocus.com/bid/64544 · Nota
• https://osv.dev/vulnerability/GHSA-f9q5-46qg-74x4 · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q4/524 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6418 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:11263-1 · Aviso do Fabricante