CVE-2013-6396

CWE-310CWE-295 — Improper Certificate Validation8 documents7 sources
Severity
5.8MEDIUM
EPSS
0.1%
top 66.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Openstack Swift
Timeline
PublishedFeb 18
Latest updateMay 17

Description

The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages3 packages

▶PyPIpython-swiftclient1.0 — 2.0
▶Debianpython-swiftclient< 1:2.0.2-1+3
▶NVDopenstack/swift26 versions+25

🔴Vulnerability Details

4
OSV
Python Swift client is vulnerable to Missing SSL Certificate Check↗2022-05-17
▶
GHSA
Python Swift client is vulnerable to Missing SSL Certificate Check↗2022-05-17
▶
CVEList
CVE-2013-6396: The OpenStack Python client library for Swift (python-swiftclient) 1↗2014-02-18
▶
OSV
CVE-2013-6396: The OpenStack Python client library for Swift (python-swiftclient) 1↗2014-02-18
▶

📋Vendor Advisories

2
Red Hat
python-swiftclient: SSL certificate verification security issue↗2013-07-10
▶
Debian
CVE-2013-6396: python-swiftclient - The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-6396 python-swiftclient: SSL certificate verification security issue↗2013-11-18
▶