Vulnerability Details : CVE-2013-4314
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Products affected by CVE-2013-4314
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.11:a1:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.10:*:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.8:a1:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.12:*:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.11:*:*:*:*:*:*:*
- cpe:2.3:a:jean-paul_calderone:pyopenssl:0.11:a2:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-4314
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 45 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-4314
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2013-4314
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4314
-
http://www.openwall.com/lists/oss-security/2013/09/06/2
oss-security - Re: CVE request: pyOpenSSL hostname check bypassing vulnerability
-
https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html
[pyOpenSSL-Users] pyOpenSSL 0.13.1
-
http://www.debian.org/security/2013/dsa-2763
Debian -- Security Information -- DSA-2763-1 pyopenssl
-
http://lists.opensuse.org/opensuse-updates/2013-11/msg00015.html
openSUSE-SU-2013:1648-1: moderate: update for python-pyOpenSSL
-
https://bugzilla.redhat.com/show_bug.cgi?id=1005325
1005325 – (CVE-2013-4314) CVE-2013-4314 pyOpenSSL: hostname check bypassing vulnerability
-
http://www.ubuntu.com/usn/USN-1965-1
USN-1965-1: pyOpenSSL vulnerability | Ubuntu security noticesVendor Advisory
Jump to