Lucene search

[email protected]NVD:CVE-2013-7440

HistoryJun 07, 2016 - 6:59 p.m.

CVE-2013-7440

2016-06-0718:59:00

CWE-19

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.7

Confidence

High

EPSS

0.002

Percentile

52.8%

JSON

The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

Affected configurations

Nvd

Node

pythonpythonRange≤2.7.8

Node

pythonpythonMatch3.0

pythonpythonMatch3.0.1

pythonpythonMatch3.1

pythonpythonMatch3.1.1

pythonpythonMatch3.1.2

pythonpythonMatch3.1.3

pythonpythonMatch3.1.4

pythonpythonMatch3.1.5

pythonpythonMatch3.1.2150x64

pythonpythonMatch3.2

pythonpythonMatch3.2alpha

pythonpythonMatch3.2.0

pythonpythonMatch3.2.1

pythonpythonMatch3.2.2

pythonpythonMatch3.2.3

pythonpythonMatch3.2.4

pythonpythonMatch3.2.5

pythonpythonMatch3.2.6

pythonpythonMatch3.2.2150

pythonpythonMatch3.3

pythonpythonMatch3.3beta2

pythonpythonMatch3.3.0

pythonpythonMatch3.3.1

pythonpythonMatch3.3.1rc1

pythonpythonMatch3.3.2

VendorProductVersionCPE
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
pythonpython3.0cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*
pythonpython3.0.1cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*
pythonpython3.1cpe:2.3:a:python:python:3.1:*:*:*:*:*:*:*
pythonpython3.1.1cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*
pythonpython3.1.2cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*
pythonpython3.1.3cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*
pythonpython3.1.4cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:*
pythonpython3.1.5cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:*
pythonpython3.1.2150cpe:2.3:a:python:python:3.1.2150:*:*:*:*:*:x64:*

Vendor	Product	Version	CPE
python	python	*	cpe:2.3:a:python:python::::::::
python	python	3.0	cpe:2.3:a:python:python:3.0:::::::*
python	python	3.0.1	cpe:2.3:a:python:python:3.0.1:::::::*
python	python	3.1	cpe:2.3:a:python:python:3.1:::::::*
python	python	3.1.1	cpe:2.3:a:python:python:3.1.1:::::::*
python	python	3.1.2	cpe:2.3:a:python:python:3.1.2:::::::*
python	python	3.1.3	cpe:2.3:a:python:python:3.1.3:::::::*
python	python	3.1.4	cpe:2.3:a:python:python:3.1.4:::::::*
python	python	3.1.5	cpe:2.3:a:python:python:3.1.5:::::::*
python	python	3.1.2150	cpe:2.3:a:python:python:3.1.2150::::::x64: