Intel

CVE-2013-4238

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in… (CVE-2013-4238)

noneEPSS 5.3%

Description

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Source: CVELISTV5OSVNVD

Metrics

Severity
none
Priority score
55.29
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
92.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
5.3 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2013-08-18 01:00 UTC
CWE
—

Affected operating systems

  • linux

    canonical / ubuntu_linux10.04

  • os

    opensuse / opensuse11.4

  • os

    opensuse / opensuse12.2

  • os

    opensuse / opensuse12.3

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • python

    python

References & sources

IDCVE-2013-4238