NetSight
IP …
medium5.8

CVE-2013-1909

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName …

Impact

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected products

VendorProductAffected versions
RedhatEnterprise Mrg
Version 2.0
ApacheQpid
through 0.20
Versions 0.5, 0.6, 0.7, 0.8, 0.9

Weakness classification

CWE-20

References