CVE-2013-6418

CVE-2013-6418 affects PyWBEM 0.7 and earlier, where certificate validation occurs over a separate connection, enabling MITM spoofing of peers via arbitrary X.509 certificates. Impact is partial confidentiality/integrity risk as described in linked advisories; exploitation details are not provided...

CVE-2013-6444

Removed by vendor...

CVE-2013-6418: Improper Input Validation

PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate...

CVE-2013-6444: Improper Input Validation

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

SuSE 11.3 Security Update : python-pywbem (SAT Patch Number 9079)

This update fixes a TOCTOU vulnerability during certificate validation. CVE-2013-6418 has been assigned to this issue. This update also introduces a new dependency on python-m2crypto. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...