cbcvebase.
CVE-2013-4238
published 2013-08-18

CVE-2013-4238: The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject…

PriorityP429medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
5.35%
91.7th percentile
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
debianpython2.7< python2.7 2.7.5-8 (bullseye)python2.7 2.7.5-8 (bullseye)
opensuseopensuse
opensuseopensuse
opensuseopensuse
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython
pythonpython

CVSS provenance

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.9MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.