CVE-2013-4314: Input Validation
The pyOpenSSL module implements hostname identity checks but it did not properly handle hostnames in the certificate that contain null bytes. In all releases prior to 0.13.1, the string formatting of subjectAltName X509Extension instances incorrectly truncated fields of the name when encountering the null byte.
When a CA than an SSL client trusts issues a server certificate that has a null byte in the subjectAltName, remote attackers can obtain a certifcate for 'www.foo.org\0.example.com' from the CA to spoof 'www.foo.org' and conduct man-in-the-middle attacks between the pyOpenSSL-using client and SSL servers.
[1] https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html
Other sources
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
— MITRE
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a \0 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4314?
CVE-2013-4314 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-4314?
To fix CVE-2013-4314, upgrade pyOpenSSL to version 0.13.1 or later.
Which versions of pyOpenSSL are affected by CVE-2013-4314?
CVE-2013-4314 affects all versions of pyOpenSSL prior to 0.13.1.
What kind of vulnerability is CVE-2013-4314?
CVE-2013-4314 involves improper handling of hostnames containing null bytes in the pyOpenSSL module.
Is there a patch available for CVE-2013-4314?
Yes, a patch is available by upgrading pyOpenSSL to version 0.13.1.