Improper input validation in Jean-Paul Calderone Pyopenssl
CVE-2013-4314
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.012 (64.9th percentile) — read the EPSS interpretation.
Affected products
- Jean-paul_calderone Pyopenssl — versions 0.7, 0.8, 0.9
- Canonical Ubuntu_linux — versions 10.04, 12.04, 12.10
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2013-4314?
- CVE-2013-4314 is a vulnerability in Jean-Paul Calderone Pyopenssl, classified under Improper Input Validation. Published 2013-09-30.
- Is CVE-2013-4314 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.