Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-0772Protection Mechanism Failure in Python

Severity
6.5MEDIUMNVD
EPSS
5.8%
top 9.50%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedSep 2
Latest updateMay 14

Description

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NExploitability: 2.2 | Impact: 4.2

Affected Packages2 packages

debiandebian/python2.7< python2.7 2.7.12~rc1-1 (bullseye)
NVDpython/python2.7.11+29

Patches

🔴Vulnerability Details

3
GHSA
GHSA-6m57-q338-h677: The smtplib library in CPython (aka Python) before 22022-05-14
OSV
python2.7, python3.2, python3.4, python3.5 vulnerabilities2016-11-22
OSV
CVE-2016-0772: The smtplib library in CPython (aka Python) before 22016-09-02

💥Exploits & PoCs

1
Exploit-DB
Python smtplib 2.7.11 / 3.4.4 / 3.5.1 - Man In The Middle StartTLS Stripping2016-07-03

📋Vendor Advisories

3
Ubuntu
Python vulnerabilities2016-11-22
Red Hat
python: smtplib StartTLS stripping attack2016-06-11
Debian
CVE-2016-0772: python2.7 - The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and...2016

💬Community

12
HackerOne
imap: StartTLS stripping attack (CVE-2016-0772).2021-07-08
HackerOne
CVE-2016-0772 - python: smtplib StartTLS stripping attack2016-08-30
Bugzilla
CVE-2016-0772 pypy3: python: smtplib StartTLS stripping attack [fedora-all]2016-06-30
Bugzilla
CVE-2016-0772 pypy: python: smtplib StartTLS stripping attack [epel-5]2016-06-30
Bugzilla
CVE-2016-0772 pypy: python: smtplib StartTLS stripping attack [epel-6]2016-06-30