Search for vulnerabilities
Vulnerability details: VCID-7chw-7puj-aaas
Vulnerability ID VCID-7chw-7puj-aaas
Aliases CVE-2013-4238
Summary The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2013:1527
rhas Moderate https://access.redhat.com/errata/RHSA-2013:1582
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03786 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.03848 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
epss 0.12663 https://api.first.org/data/v1/epss?cve=CVE-2013-4238
generic_textual MODERATE http://seclists.org/fulldisclosure/2014/Dec/23
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2013-4238
generic_textual HIGH http://www.securityfocus.com/archive/1/534161/100/0/threaded
generic_textual MODERATE http://www.vmware.com/security/advisories/VMSA-2014-0012.html
Reference id Reference type URL
http://bugs.python.org/issue18709
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00026.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00027.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00028.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00029.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00042.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00043.html
http://rhn.redhat.com/errata/RHSA-2013-1582.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4238.json
https://api.first.org/data/v1/epss?cve=CVE-2013-4238
https://bugzilla.redhat.com/show_bug.cgi?id=996381
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4238
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1912
http://seclists.org/fulldisclosure/2014/Dec/23
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
http://www.debian.org/security/2014/dsa-2880
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://www.ubuntu.com/usn/USN-1982-1
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
719566 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719566
cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.2150:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.2150:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.3:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.6150:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.6150:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.7:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.7:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.6.8:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.6.8:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.1150:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.1150:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.1150:*:*:*:*:*:x64:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.1150:*:*:*:*:*:x64:*
cpe:2.3:a:python:python:2.7.1:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.1:rc1:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.2150:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.2150:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.2:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.2:rc1:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.3:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.1.2150:*:*:*:*:*:x64:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1.2150:*:*:*:*:*:x64:*
cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.2:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.2.2150:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.2.2150:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.2.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.2:alpha:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.2:alpha:*:*:*:*:*:*
cpe:2.3:a:python:python:3.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.3:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.3:beta2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.3:beta2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.4:alpha1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.4:alpha1:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
CVE-2013-4238 https://nvd.nist.gov/vuln/detail/CVE-2013-4238
RHSA-2013:1527 https://access.redhat.com/errata/RHSA-2013:1527
RHSA-2013:1582 https://access.redhat.com/errata/RHSA-2013:1582
USN-1982-1 https://usn.ubuntu.com/1982-1/
USN-1983-1 https://usn.ubuntu.com/1983-1/
USN-1984-1 https://usn.ubuntu.com/1984-1/
USN-1985-1 https://usn.ubuntu.com/1985-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2013-4238
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.58122
EPSS Score 0.00198
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.