CVE-2013-7440

Severity

43%

Complexity

86%

Confidentiality

48%

The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

CVSS 3.0 Base Score 5.9. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N).

Overview

First reported 8 years ago

2016-06-07 18:59:00

Last updated 8 years ago

2016-11-28 19:10:00

Affected Software

Python

Python 3.0

3.0

Python 3.0.1

3.0.1

Python 3.1

3.1

Python 3.1.1

3.1.1

Python 3.1.2

3.1.2

Python 3.1.3

3.1.3

Python 3.1.4

3.1.4

Python 3.1.5

3.1.5

Python 3.1.2150 (x64) 64-bit

3.1.2150

Python 3.2

3.2

Python 3.2-alpha

3.2

Python 3.2.0

3.2.0

Python 3.2.1

3.2.1

Python 3.2.2

3.2.2

Python 3.2.3

3.2.3

Python 3.2.4

3.2.4

Python 3.2.5

3.2.5

Python 3.2.6

3.2.6

Python 3.2.2150

3.2.2150

Python 3.3

3.3

Python 3.3 beta 2

3.3

Python 3.3.0

3.3.0

Python 3.3.1

3.3.1

Python 3.3.1 release candidate 1