CVE-2013-7440

Published: Jun 7, 2016Modified: May 6, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

Affected (26)

Products: Python: Python

Python

1 product

Python

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Python	Up to 2.7.8

Configuration B

25 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 3.0.1
Python Python	Version 3.0
Python Python	Version 3.1.1
Python Python	Version 3.1.2150
Python Python	Version 3.1.2
Python Python	Version 3.1.3
Python Python	Version 3.1.4
Python Python	Version 3.1.5
Python Python	Version 3.1
Python Python	Version 3.2.0
Python Python	Version 3.2.1
Python Python	Version 3.2.2150
Python Python	Version 3.2.2
Python Python	Version 3.2.3
Python Python	Version 3.2.4
Python Python	Version 3.2.5
Python Python	Version 3.2.6
Python Python	Version 3.2
Python Python	Version 3.2 alpha
Python Python	Version 3.3.0
Python Python	Version 3.3.1
Python Python	Version 3.3.1 rc1
Python Python	Version 3.3.2
Python Python	Version 3.3
Python Python	Version 3.3 beta2