CVE-2013-1909: Input Validation
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1909?
CVE-2013-1909 is considered a medium severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2013-1909?
To fix CVE-2013-1909, upgrade to a version of the qpid-python package that is newer than 0.22.
Which versions of Apache Qpid are affected by CVE-2013-1909?
CVE-2013-1909 affects Apache Qpid versions up to 0.20 and specific versions like 0.5 through 0.19.
Can CVE-2013-1909 be exploited remotely?
Yes, CVE-2013-1909 can be exploited remotely by attackers who can spoof SSL servers with valid certificates.
What components of Apache Qpid does CVE-2013-1909 impact?
CVE-2013-1909 impacts the Python client component of Apache Qpid.