CVE-2013-7440: Medium severity Python Python vulnerability
It was found that Python's SSL hostname matching rules did not conform to RFC 6125 when the hostname included wildcards.
Upstream issue:
https://bugs.python.org/issue17997#msg194950
CVE assignment:
http://seclists.org/oss-sec/2015/q2/523
Upstream patch:
https://hg.python.org/cpython/rev/10d0edadbcdd
Other sources
The ssl.matchhostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7440?
CVE-2013-7440 is considered a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2013-7440?
To fix CVE-2013-7440, upgrade to Python version 2.7.9 or 3.3.3 and above, which include the necessary patches.
Which versions of Python are affected by CVE-2013-7440?
CVE-2013-7440 affects Python versions prior to 2.7.9 and 3.x versions prior to 3.3.3.
What type of attack does CVE-2013-7440 allow?
CVE-2013-7440 allows attackers to perform man-in-the-middle attacks by spoofing a server with a crafted certificate.
Is CVE-2013-7440 specific to any operating system?
CVE-2013-7440 is found in CPython, affecting all operating systems where these vulnerable versions of Python are installed.