CVE-2013-6444

Published: May 5, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected (1)

Products: Pywbem Project: Pywbem

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pywbem Project Pywbem	Up to 0.7

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://seclists.org/oss-sec/2013/q4/524

Source: secalert@redhat.com

http://sourceforge.net/p/pywbem/code/627/

Source: secalert@redhat.com

Vendor Advisory

http://sourceforge.net/p/pywbem/mailman/message/31757312/

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/64544

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1044246

Source: secalert@redhat.com

http://seclists.org/oss-sec/2013/q4/524

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/p/pywbem/code/627/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://sourceforge.net/p/pywbem/mailman/message/31757312/

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/64544

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1044246

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.