CVE-2013-6418

Published: May 5, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.

Affected (1)

Products: Pywbem Project: Pywbem

Pywbem Project

1 product

Pywbem

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pywbem Project Pywbem	Up to 0.7

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://seclists.org/oss-sec/2013/q4/531

Source: secalert@redhat.com

http://secunia.com/advisories/58327

Source: secalert@redhat.com

http://sourceforge.net/p/pywbem/code/627/

Source: secalert@redhat.com

Vendor Advisory

http://sourceforge.net/p/pywbem/mailman/message/31757312/

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/64544

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1039801

Source: secalert@redhat.com

https://www.suse.com/support/update/announcement/2014/suse-su-20140580-1.html

Source: secalert@redhat.com

http://seclists.org/oss-sec/2013/q4/531