4.3

CVE-2013-4238

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version10.04 Update- Editionlts
Python ≫ Python Version2.6.1
Python ≫ Python Version2.6.2
Python ≫ Python Version2.6.3
Python ≫ Python Version2.6.4
Python ≫ Python Version2.6.5
Python ≫ Python Version2.6.6
Python ≫ Python Version2.6.7
Python ≫ Python Version2.6.8
Python ≫ Python Version2.6.2150
Python ≫ Python Version2.6.6150
Python ≫ Python Version2.7.1
Python ≫ Python Version2.7.1 Updaterc1
Python ≫ Python Version2.7.2 Updaterc1
Python ≫ Python Version2.7.3
Python ≫ Python Version2.7.1150
Python ≫ Python Version2.7.1150 HwPlatformx64
Python ≫ Python Version2.7.2150
Python ≫ Python Version3.0
Python ≫ Python Version3.0.1
Python ≫ Python Version3.1
Python ≫ Python Version3.1.1
Python ≫ Python Version3.1.2
Python ≫ Python Version3.1.3
Python ≫ Python Version3.1.4
Python ≫ Python Version3.1.5
Python ≫ Python Version3.1.2150 HwPlatformx64
Python ≫ Python Version3.2
Python ≫ Python Version3.2 Updatealpha
Python ≫ Python Version3.2.3
Python ≫ Python Version3.2.2150
Python ≫ Python Version3.3
Python ≫ Python Version3.3 Updatebeta2
Python ≫ Python Version3.4 Updatealpha1
Opensuse ≫ Opensuse Version11.4
Opensuse ≫ Opensuse Version12.2
Opensuse ≫ Opensuse Version12.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.03% 0.88
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.