Lucene search

K

[email protected]NVD:CVE-2013-4238

HistoryAug 18, 2013 - 2:52 a.m.

CVE-2013-4238

2013-08-1802:52:22

CWE-20

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.4%

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a ‘\0’ character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected configurations

NVD

Node

canonicalubuntu_linuxMatch10.04-lts

Node

pythonpythonMatch2.6.1

OR

pythonpythonMatch2.6.2

OR

pythonpythonMatch2.6.3

OR

pythonpythonMatch2.6.4

OR

pythonpythonMatch2.6.5

OR

pythonpythonMatch2.6.6

OR

pythonpythonMatch2.6.7

OR

pythonpythonMatch2.6.8

OR

pythonpythonMatch2.6.2150

OR

pythonpythonMatch2.6.6150

OR

pythonpythonMatch2.7.1

OR

pythonpythonMatch2.7.1rc1

OR

pythonpythonMatch2.7.2rc1

OR

pythonpythonMatch2.7.3

OR

pythonpythonMatch2.7.1150

OR

pythonpythonMatch2.7.1150x64

OR

pythonpythonMatch2.7.2150

OR

pythonpythonMatch3.0

OR

pythonpythonMatch3.0.1

OR

pythonpythonMatch3.1

OR

pythonpythonMatch3.1.1

OR

pythonpythonMatch3.1.2

OR

pythonpythonMatch3.1.3

OR

pythonpythonMatch3.1.4

OR

pythonpythonMatch3.1.5

OR

pythonpythonMatch3.1.2150x64

OR

pythonpythonMatch3.2

OR

pythonpythonMatch3.2alpha

OR

pythonpythonMatch3.2.3

OR

pythonpythonMatch3.2.2150

OR

pythonpythonMatch3.3

OR

pythonpythonMatch3.3beta2

OR

pythonpythonMatch3.4alpha1

Node

opensuseopensuseMatch11.4

OR

opensuseopensuseMatch12.2

OR

opensuseopensuseMatch12.3

References

bugs.python.org/issue18709

lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

lists.opensuse.org/opensuse-updates/2013-09/msg00026.html

lists.opensuse.org/opensuse-updates/2013-09/msg00027.html

lists.opensuse.org/opensuse-updates/2013-09/msg00028.html

lists.opensuse.org/opensuse-updates/2013-09/msg00029.html

lists.opensuse.org/opensuse-updates/2013-09/msg00042.html

lists.opensuse.org/opensuse-updates/2013-09/msg00043.html

rhn.redhat.com/errata/RHSA-2013-1582.html

seclists.org/fulldisclosure/2014/Dec/23

www.debian.org/security/2014/dsa-2880

www.securityfocus.com/archive/1/534161/100/0/threaded

www.ubuntu.com/usn/USN-1982-1

www.vmware.com/security/advisories/VMSA-2014-0012.html

bugzilla.redhat.com/show_bug.cgi?id=996381

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.4%

Related for NVD:CVE-2013-4238

nessus45 openvas51 amazon2 f54 cvelist15 veracode2 debiancve10 prion16 cve16 ubuntucve8 threatpost1 nvd13 seebug2 securityvulns5 exploitdb1 oraclelinux1 redhat1 ubuntu1 fedora3 centos1 mozilla1