CVE-2013-2100: Critical severity gentoo portage vulnerability
The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2100?
CVE-2013-2100 is classified as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2013-2100?
To fix CVE-2013-2100, upgrade to a patched version of Portage, specifically version 2.1.12.2 or later.
What does CVE-2013-2100 affect?
CVE-2013-2100 affects Gentoo Portage version 2.1.12 when using HTTPS connections.
What type of attack does CVE-2013-2100 allow?
CVE-2013-2100 allows man-in-the-middle attackers to spoof servers and alter binary package lists.
Which function is vulnerable in CVE-2013-2100?
The vulnerability in CVE-2013-2100 is found in the urlopen function of pym/portage/util/_urlopen.py.