CVE-2013-7440
First published: Tue May 26 2015(Updated: )
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Python Python | <=2.7.8 | |
| Python Python | =3.0 | |
| Python Python | =3.0.1 | |
| Python Python | =3.1 | |
| Python Python | =3.1.1 | |
| Python Python | =3.1.2 | |
| Python Python | =3.1.3 | |
| Python Python | =3.1.4 | |
| Python Python | =3.1.5 | |
| Python Python | =3.1.2150 | |
| Python Python | =3.2 | |
| Python Python | =3.2-alpha | |
| Python Python | =3.2.0 | |
| Python Python | =3.2.1 | |
| Python Python | =3.2.2 | |
| Python Python | =3.2.3 | |
| Python Python | =3.2.4 | |
| Python Python | =3.2.5 | |
| Python Python | =3.2.6 | |
| Python Python | =3.2.2150 | |
| Python Python | =3.3 | |
| Python Python | =3.3-beta2 | |
| Python Python | =3.3.0 | |
| Python Python | =3.3.1 | |
| Python Python | =3.3.1-rc1 | |
| Python Python | =3.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/oss-sec/2015/q2/483
- http://seclists.org/oss-sec/2015/q2/523
- http://www.securityfocus.com/bid/74707
- https://access.redhat.com/errata/RHSA-2016:1166
- https://bugs.python.org/issue17997
- https://bugzilla.redhat.com/show_bug.cgi?id=1224999
- https://hg.python.org/cpython/rev/10d0edadbcdd
- https://bugs.python.org/issue17997#msg194950
- https://pypi.python.org/pypi/backports.ssl_match_hostname/3.4.0.2
- https://github.com/pypa/pip/commit/c61b5df
- https://access.redhat.com/security/cve/CVE-2013-7440
- https://access.redhat.com/security/cve/CVE-2013-2099
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=963260
- https://github.com/pypa/pip/commit/651a961
- https://github.com/pypa/pip/commit/320a07f
- https://bitbucket.org/vinay.sajip/distlib/commits/1e44690
- https://bitbucket.org/pypa/setuptools/commits/8dc5794
- https://bitbucket.org/pypa/setuptools/commits/4b0fb61
- https://bitbucket.org/pypa/setuptools/commits/7eeb678
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1230953
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1230954
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1230951
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1230952
- https://jira.mongodb.org/browse/PYTHON-466
- https://github.com/mongodb/mongo-python-driver/commit/48046b2e
- https://jira.mongodb.org/browse/PYTHON-522
- https://github.com/mongodb/mongo-python-driver/commit/e4f6e4f7
- https://jira.mongodb.org/browse/PYTHON-650
- https://github.com/mongodb/mongo-python-driver/commit/9b0e542a
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1231231
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1231232
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1231238
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1231239
- https://access.redhat.com/security/updates/classification/
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-7440
- agent/software-canonical-lookup
- vendor/python
- canonical/python python
- version/python python/2.7.8
- version/python python/3.0
- version/python python/3.0.1
- version/python python/3.1
- version/python python/3.1.1
- version/python python/3.1.2
- version/python python/3.1.3
- version/python python/3.1.4
- version/python python/3.1.5
- version/python python/3.1.2150
- version/python python/3.2
- version/python python/3.2-alpha
- version/python python/3.2.0
- version/python python/3.2.1
- version/python python/3.2.2
- version/python python/3.2.3
- version/python python/3.2.4
- version/python python/3.2.5
- version/python python/3.2.6
- version/python python/3.2.2150
- version/python python/3.3
- version/python python/3.3-beta2
- version/python python/3.3.0
- version/python python/3.3.1
- version/python python/3.3.1-rc1
- version/python python/3.3.2
- package-manager/redhat