NetSight
IP …
medium4.3

CVE-2013-4238

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternati…

Impact

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Version 10.04
PythonPython
Versions 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6
OpensuseOpensuse
Versions 11.4, 12.2, 12.3

Weakness classification

CWE-20

References