CVE-2013-1909
published 2013-08-23CVE-2013-1909: The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName…
PriorityP427medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
1.57%
72.5th percentile
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid | <= 0.20 | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| apache | qpid | — | — |
| redhat | enterprise_mrg | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python-qpid: client does not validate qpid server TLS/SSL certificate
vendor_redhat·2013-06-13·CVSS 5.8
CVE-2013-1909 [MEDIUM] python-qpid: client does not validate qpid server TLS/SSL certificate
python-qpid: client does not validate qpid server TLS/SSL certificate
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Package: python-qpid (Red Hat Enterprise Linux 6) - Will not fix
Package: python-qpid (Red Hat Satellite 6) - Not affected
OSV
Apache Qpid Python client Improper certificate validation
osv·2022-05-13
CVE-2013-1909 [HIGH] Apache Qpid Python client Improper certificate validation
Apache Qpid Python client Improper certificate validation
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
GHSA
Apache Qpid Python client Improper certificate validation
ghsa·2022-05-13
CVE-2013-1909 [HIGH] CWE-20 Apache Qpid Python client Improper certificate validation
Apache Qpid Python client Improper certificate validation
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
OSV
CVE-2013-1909: The Python client in Apache Qpid before 2
osv·2013-08-23
CVE-2013-1909 CVE-2013-1909: The Python client in Apache Qpid before 2
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1909 python-qpid: client does not validate Certificate Authority certificates nor checks CN/SubjectAltName against remote FQDN [fedora-all]
bugzilla·2013-06-14·CVSS 5.8
CVE-2013-1909 [MEDIUM] CVE-2013-1909 python-qpid: client does not validate Certificate Authority certificates nor checks CN/SubjectAltName against remote FQDN [fedora-all]
CVE-2013-1909 python-qpid: client does not validate Certificate Authority certificates nor checks CN/SubjectAltName against remote FQDN [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog
Bugzilla
CVE-2013-1909 python-qpid: client does not validate qpid server TLS/SSL certificate
bugzilla·2013-03-27·CVSS 5.8
CVE-2013-1909 [MEDIUM] CVE-2013-1909 python-qpid: client does not validate qpid server TLS/SSL certificate
CVE-2013-1909 python-qpid: client does not validate qpid server TLS/SSL certificate
Multiple security flaws were found in the QPID Python's SSL certificate validation code. Details:
While the QPID client connection API allows for a list of Certificate Authority certificates to be provided when connecting, if the remote certificate does not validate against the CA certs, the client connection will continue. This is due in part to the python SSL library not validating certificates supplied by the remote system unless the CERT_REQUIRED flag is set when making the connection [1] (the QPID python client code does not set this flag). However, this is only valid on systems using a version of python >= 2.6; on earlier versions of Python the CAs parameter is simply ignored [2] (see ssl() section)
http://qpid.apache.org/releases/qpid-0.22/release-notes.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1024.htmlhttp://secunia.com/advisories/53968http://secunia.com/advisories/54137http://svn.apache.org/viewvc?view=revision&revision=1460013https://issues.apache.org/jira/browse/QPID-4918http://qpid.apache.org/releases/qpid-0.22/release-notes.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1024.htmlhttp://secunia.com/advisories/53968http://secunia.com/advisories/54137http://svn.apache.org/viewvc?view=revision&revision=1460013https://issues.apache.org/jira/browse/QPID-4918
2013-08-23
Published