CVE-2013-7440
python: wildcard matching rules do not follow RFC 6125
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
La función ssl.match_hostname en CPython (también concida como Python) en versiones anteriores a 2.7.9 y 3.x en versiones anteriores a 3.3.3 no maneja correctamente comodines en los nombres de host, lo que podría permitir a atacantes man-in-the-middle suplantar servidores a través de un certificado manipulado.
Multiple flaws were found in the way Python's SSL module performed matching of certificate names containing wildcards. A remote attacker able to obtain a valid certificate that contained certain names with wildcards could have them incorrectly accepted by Python SSL clients, not following the RFC 6125 recommendations.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-05-19 CVE Reserved
- 2016-05-31 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-19: Data Processing Errors
CAPEC
References (8)
URL | Tag | Source |
---|---|---|
http://seclists.org/oss-sec/2015/q2/483 | Mailing List | |
http://seclists.org/oss-sec/2015/q2/523 | Mailing List | |
http://www.securityfocus.com/bid/74707 | Vdb Entry | |
https://bugs.python.org/issue17997 | X_refsource_confirm | |
https://hg.python.org/cpython/rev/10d0edadbcdd | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2016:1166 | 2016-11-28 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1224999 | 2016-05-31 | |
https://access.redhat.com/security/cve/CVE-2013-7440 | 2016-05-31 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | <= 2.7.8 Search vendor "Python" for product "Python" and version " <= 2.7.8" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.0 Search vendor "Python" for product "Python" and version "3.0" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.0.1 Search vendor "Python" for product "Python" and version "3.0.1" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1 Search vendor "Python" for product "Python" and version "3.1" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.1 Search vendor "Python" for product "Python" and version "3.1.1" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.2 Search vendor "Python" for product "Python" and version "3.1.2" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.3 Search vendor "Python" for product "Python" and version "3.1.3" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.4 Search vendor "Python" for product "Python" and version "3.1.4" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.5 Search vendor "Python" for product "Python" and version "3.1.5" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.1.2150 Search vendor "Python" for product "Python" and version "3.1.2150" | x64 |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2 Search vendor "Python" for product "Python" and version "3.2" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2 Search vendor "Python" for product "Python" and version "3.2" | alpha |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.0 Search vendor "Python" for product "Python" and version "3.2.0" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.1 Search vendor "Python" for product "Python" and version "3.2.1" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.2 Search vendor "Python" for product "Python" and version "3.2.2" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.3 Search vendor "Python" for product "Python" and version "3.2.3" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.4 Search vendor "Python" for product "Python" and version "3.2.4" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.5 Search vendor "Python" for product "Python" and version "3.2.5" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.6 Search vendor "Python" for product "Python" and version "3.2.6" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.2.2150 Search vendor "Python" for product "Python" and version "3.2.2150" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3 Search vendor "Python" for product "Python" and version "3.3" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3 Search vendor "Python" for product "Python" and version "3.3" | beta2 |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.0 Search vendor "Python" for product "Python" and version "3.3.0" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.1 Search vendor "Python" for product "Python" and version "3.3.1" | - |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.1 Search vendor "Python" for product "Python" and version "3.3.1" | rc1 |
Affected
| ||||||
Python Search vendor "Python" | Python Search vendor "Python" for product "Python" | 3.3.2 Search vendor "Python" for product "Python" and version "3.3.2" | - |
Affected
|