4.3

CVE-2013-4314

The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jean-paul Calderone ≫ Pyopenssl Version <= 0.13
Jean-paul Calderone ≫ Pyopenssl Version 0.7
Jean-paul Calderone ≫ Pyopenssl Version 0.8 Update a1
Jean-paul Calderone ≫ Pyopenssl Version 0.9
Jean-paul Calderone ≫ Pyopenssl Version 0.10
Jean-paul Calderone ≫ Pyopenssl Version 0.11
Jean-paul Calderone ≫ Pyopenssl Version 0.11 Update a1
Jean-paul Calderone ≫ Pyopenssl Version 0.11 Update a2
Jean-paul Calderone ≫ Pyopenssl Version 0.12
Canonical ≫ Ubuntu Linux Version 10.04 Update - Edition lts
Canonical ≫ Ubuntu Linux Version 12.04 Update - Edition lts
Canonical ≫ Ubuntu Linux Version 12.10
Canonical ≫ Ubuntu Linux Version 13.04
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.2% 0.641
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-updates/2013-11/msg00015.html
http://www.debian.org/security/2013/dsa-2763
http://www.openwall.com/lists/oss-security/2013/09/06/2
http://www.ubuntu.com/usn/USN-1965-1
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1005325
https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html