4.3

CVE-2013-4314

The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jean-paul Calderone ≫ Pyopenssl Version <= 0.13
Jean-paul Calderone ≫ Pyopenssl Version0.8 Updatea1
Jean-paul Calderone ≫ Pyopenssl Version0.10
Jean-paul Calderone ≫ Pyopenssl Version0.11
Jean-paul Calderone ≫ Pyopenssl Version0.11 Updatea1
Jean-paul Calderone ≫ Pyopenssl Version0.11 Updatea2
Jean-paul Calderone ≫ Pyopenssl Version0.12
Canonical ≫ Ubuntu Linux Version10.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version12.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version12.10
Canonical ≫ Ubuntu Linux Version13.04
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.453
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.