PT-2013-3541 · Python+1 · Python+2

Florian Weimer + 1 · Published 2013-05-16 · Updated 2023-02-13 · CVE-2013-2099

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Python versions prior to 3.4 python-backports-ssl match hostname (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by exploiting the ssl.match hostname function. This is achieved through the use of multiple wildcard characters in the common name of a certificate.

Recommendations For Python versions prior to 3.4, update to version 3.4 or later to resolve the issue. For python-backports-ssl match hostname, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2016-1294

CVE-2013-2099

DLA-1107-1

MGASA-2013-0252

PSF-2013-1

RHSA-2014:1263

RHSA-2014:1690

RHSA-2015:0042

RHSA-2016:1166

USN-1983-1

USN-1984-1

USN-1985-1

Affected Products

Alt Linux

Python

Python-Backports-Ssl Match Hostname

References · 57

• 🔥 https://github.com/bunseokbot/CVE-2016-5699-poc · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7338 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7440 · Security Note
• http://ubuntu.com/usn/USN-1983-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2099 · Security Note
• https://access.redhat.com/errata/RHSA-2016:1166 · Vendor Advisory
• http://secunia.com/advisories/55107 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2099 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2099 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-1294 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1912 · Security Note
• https://ubuntu.com/security/notices/USN-1983-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2099 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1753 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5699 · Security Note