PT-2014-3107 · Python+1 · Pywbem+1

Florian Weimer · Published 2014-04-29 · Updated 2024-06-15 · CVE-2013-6418

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyWBEM versions 0.7 and earlier

Description The issue allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate, as PyWBEM uses a separate connection to validate X.509 certificates.

Recommendations For PyWBEM versions 0.7 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

AZL-41410

AZL-45129

CVE-2013-6418

GHSA-F9Q5-46QG-74X4

OPENSUSE-SU-2024:11263-1

OPENSUSE-SU-2024:13977-1

PYSEC-2014-93

SUSE-SU-2014_0580-1

Affected Products

Pywbem

Suse

References · 26

• https://suse.com/support/update/announcement/2014/suse-su-20140580-1.html · Vendor Advisory
• http://sourceforge.net/p/pywbem/code/627 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13977-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45129 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-6418 · Security Note
• https://osv.dev/vulnerability/GHSA-f9q5-46qg-74x4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6418 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11263-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6418 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-41410 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6418 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-93 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pywbem/PYSEC-2014-93.yaml · Note
• https://github.com/pywbem/pywbem · Note
• https://github.com/pywbem/pywbem/commit/f7599379b26a685d772b2620a16316130f46c474 · Note