PT-2013-4915 · Python+3 · Python+3
Murray Mcallister
·
Published
2013-08-17
·
Updated
2025-11-07
·
CVE-2013-4238
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 2.6 through 3.4
Description
The issue arises from the
ssl.match hostname function in the SSL module, which fails to properly handle a '0' character in a domain name in the Subject Alternative Name field of an X.509 certificate. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.Recommendations
For Python versions 2.6 through 3.4, consider updating to a version where this issue is resolved, as the current version is affected by this issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Python
Red Hat
Suse