Executive Summary

Informations
Name CVE-2013-4238 First vendor Publication 2013-08-17
Vendor Cve Last vendor Modification 2019-10-25

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4238

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18405
 
Oval ID: oval:org.mitre.oval:def:18405
Title: USN-1983-1 -- python2.7 vulnerabilities
Description: Several security issues were fixed in Python.
Family: unix Class: patch
Reference(s): USN-1983-1
CVE-2013-2099
CVE-2013-4238
 Version: 5
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
 Product(s): python2.7
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18739
 
Oval ID: oval:org.mitre.oval:def:18739
Title: USN-1984-1 -- python3.2 vulnerabilities
Description: Several security issues were fixed in Python.
Family: unix Class: patch
Reference(s): USN-1984-1
CVE-2013-2099
CVE-2013-4238
 Version: 5
Platform(s): Ubuntu 12.10
Ubuntu 12.04
 Product(s): python3.2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19336
 
Oval ID: oval:org.mitre.oval:def:19336
Title: USN-1982-1 -- python2.6 vulnerability
Description: Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.
Family: unix Class: patch
Reference(s): USN-1982-1
CVE-2013-4238
 Version: 5
Platform(s): Ubuntu 10.04
 Product(s): python2.6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19404
 
Oval ID: oval:org.mitre.oval:def:19404
Title: USN-1985-1 -- python3.3 vulnerabilities
Description: Several security issues were fixed in Python.
Family: unix Class: patch
Reference(s): USN-1985-1
CVE-2013-2099
CVE-2013-4238
 Version: 5
Platform(s): Ubuntu 13.04
Ubuntu 12.10
 Product(s): python3.3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20626
 
Oval ID: oval:org.mitre.oval:def:20626
Title: RHSA-2013:1582: python security, bug fix, and enhancement update (Moderate)
Description: The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Family: unix Class: patch
Reference(s): RHSA-2013:1582-02
CESA-2013:1582
CVE-2013-4238
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): python
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24190
 
Oval ID: oval:org.mitre.oval:def:24190
Title: ELSA-2013:1582: python security, bug fix, and enhancement update (Moderate)
Description: The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Family: unix Class: patch
Reference(s): ELSA-2013:1582-02
CVE-2013-4238
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): python
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25435
 
Oval ID: oval:org.mitre.oval:def:25435
Title: SUSE-SU-2013:1618-1 -- Security update for Python
Description: This python update fixes a certificate hostname issue. * bnc#834601: CVE-2013-4238: python: SSL module does not handle certificates that contain hostnames with NULL bytes Security Issue reference: * CVE-2013-4238 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4238 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1618-1
CVE-2013-4238
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
 Product(s): Python
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27225
 
Oval ID: oval:org.mitre.oval:def:27225
Title: DEPRECATED: ELSA-2013-1582 -- python security, bug fix, and enhancement update (moderate)
Description: [2.6.6-51] - Fixed memory leak in _ssl._get_peer_alt_names Resolves: rhbz#1002983
Family: unix Class: patch
Reference(s): ELSA-2013-1582
CVE-2013-4238
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): python
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 33
Os 1
Os 3

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-12-11 IAVM : 2014-B-0162 - VMware vCenter Server 5.1 Certificate Validation Vulnerability
Severity : Category I - VMSKEY : V0057685
2014-12-11 IAVM : 2014-B-0159 - VMware vCenter Server Appliance 5.1 Cross-site Scripting Vulnerability
Severity : Category II - VMSKEY : V0057687
2014-12-11 IAVM : 2014-A-0191 - VMware vCenter Server 5.0 Certificate Validation Vulnerability
Severity : Category I - VMSKEY : V0057699
2014-12-11 IAVM : 2014-B-0161 - Multiple Vulnerabilities in VMware ESXi 5.1
Severity : Category I - VMSKEY : V0057717

Nessus® Vulnerability Scanner

Date Description
2015-12-30 Name : The remote VMware ESXi host is missing a security-related patch.
File : vmware_VMSA-2014-0012_remote.nasl - Type : ACT_GATHER_INFO
2014-12-12 Name : The remote host has a virtualization management application installed that is...
File : vmware_vcenter_vmsa-2014-0012.nasl - Type : ACT_GATHER_INFO
2014-12-12 Name : The remote host has an update manager installed that is affected by multiple ...
File : vmware_vcenter_update_mgr_vmsa-2014-0012.nasl - Type : ACT_GATHER_INFO
2014-12-12 Name : The remote host has a virtualization appliance installed that is affected by ...
File : vmware_vcenter_server_appliance_vmsa-2014-0012.nasl - Type : ACT_GATHER_INFO
2014-12-12 Name : The remote VMware ESXi 5.1 host is affected by multiple vulnerabilities.
File : vmware_esxi_5_1_build_2323236_remote.nasl - Type : ACT_GATHER_INFO
2014-12-06 Name : The remote VMware ESXi host is missing a security-related patch.
File : vmware_VMSA-2014-0012.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0012.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1582.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1527.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-278.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-213.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-697.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-696.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-695.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-694.nasl - Type : ACT_GATHER_INFO
2014-04-04 Name : The remote host contains an application that is affected by multiple vulnerab...
File : macosx_libreoffice_420.nasl - Type : ACT_GATHER_INFO
2014-04-04 Name : The remote host contains an application that is affected by multiple vulnerab...
File : libreoffice_420.nasl - Type : ACT_GATHER_INFO
2014-03-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2880.nasl - Type : ACT_GATHER_INFO
2014-03-07 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_python-201402-140224.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131121_python_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-11-29 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1582.nasl - Type : ACT_GATHER_INFO
2013-11-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1582.nasl - Type : ACT_GATHER_INFO
2013-11-14 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-241.nasl - Type : ACT_GATHER_INFO
2013-11-01 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_python-201310-130927.nasl - Type : ACT_GATHER_INFO
2013-10-02 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1985-1.nasl - Type : ACT_GATHER_INFO
2013-10-02 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1984-1.nasl - Type : ACT_GATHER_INFO
2013-10-02 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1983-1.nasl - Type : ACT_GATHER_INFO
2013-10-02 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1982-1.nasl - Type : ACT_GATHER_INFO
2013-10-01 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-220.nasl - Type : ACT_GATHER_INFO
2013-08-28 Name : The remote Fedora host is missing a security update.
File : fedora_2013-15254.nasl - Type : ACT_GATHER_INFO
2013-08-25 Name : The remote Fedora host is missing a security update.
File : fedora_2013-15146.nasl - Type : ACT_GATHER_INFO
2013-08-22 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-214.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BUGTRAQ http://www.securityfocus.com/archive/1/534161/100/0/threaded
CONFIRM http://bugs.python.org/issue18709
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
https://bugzilla.redhat.com/show_bug.cgi?id=996381
DEBIAN http://www.debian.org/security/2014/dsa-2880
FULLDISC http://seclists.org/fulldisclosure/2014/Dec/23
REDHAT http://rhn.redhat.com/errata/RHSA-2013-1582.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00026.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00027.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00028.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00029.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00042.html
http://lists.opensuse.org/opensuse-updates/2013-09/msg00043.html
UBUNTU http://www.ubuntu.com/usn/USN-1982-1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
Date Informations
2024-02-02 01:24:04
  • Multiple Updates
2024-02-01 12:07:10
  • Multiple Updates
2023-09-05 12:22:44
  • Multiple Updates
2023-09-05 01:07:05
  • Multiple Updates
2023-09-02 12:22:46
  • Multiple Updates
2023-09-02 01:07:09
  • Multiple Updates
2023-08-22 12:20:30
  • Multiple Updates
2022-10-11 01:06:51
  • Multiple Updates
2021-05-04 12:27:10
  • Multiple Updates
2021-04-22 01:32:52
  • Multiple Updates
2021-01-07 12:10:03
  • Multiple Updates
2020-07-10 12:09:05
  • Multiple Updates
2020-05-23 00:37:55
  • Multiple Updates
2018-10-31 00:20:32
  • Multiple Updates
2018-10-10 00:19:45
  • Multiple Updates
2018-01-26 12:04:58
  • Multiple Updates
2016-04-26 23:31:27
  • Multiple Updates
2015-12-31 13:26:04
  • Multiple Updates
2015-10-18 17:22:20
  • Multiple Updates
2014-12-13 13:24:48
  • Multiple Updates
2014-12-12 09:22:42
  • Multiple Updates
2014-12-07 13:26:17
  • Multiple Updates
2014-11-13 13:26:53
  • Multiple Updates
2014-11-08 13:31:05
  • Multiple Updates
2014-06-14 13:36:01
  • Multiple Updates
2014-04-05 13:22:02
  • Multiple Updates
2014-03-26 13:22:39
  • Multiple Updates
2014-03-19 13:21:28
  • Multiple Updates
2014-03-08 13:21:05
  • Multiple Updates
2014-02-17 11:21:51
  • Multiple Updates
2013-12-08 13:19:31
  • Multiple Updates
2013-10-25 21:20:10
  • Multiple Updates
2013-10-23 21:19:59
  • Multiple Updates
2013-10-11 13:27:03
  • Multiple Updates
2013-10-03 21:21:23
  • Multiple Updates
2013-09-26 21:22:56
  • Multiple Updates
2013-09-18 13:20:27
  • Multiple Updates
2013-09-10 21:24:32
  • Multiple Updates
2013-08-20 17:22:58
  • First insertion