CVE-2013-2100

CWE-3105 documents5 sources
Severity
9.3CRITICAL
EPSS
0.6%
top 31.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Gentoo Portage
Timeline
PublishedSep 29
Latest updateMay 17

Description

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDgentoo/portage2.1.12
▶PyPIportage< 2.1.12.2

Patches

Patch: bugs.gentoo.org ↗Patch: bugs.gentoo.org ↗

🔴Vulnerability Details

3
OSV
Gentoo Portage does not verify X.509 certificates from SSL servers↗2022-05-17
▶
GHSA
Gentoo Portage does not verify X.509 certificates from SSL servers↗2022-05-17
▶
CVEList
CVE-2013-2100: The urlopen function in pym/portage/util/_urlopen↗2014-09-29
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: code execution flaw (APSB13-16)↗2013-06-11
▶
CVE-2013-2100 (CRITICAL CVSS 9.3) | The urlopen function in pym/portage | cvebase.io