CVE-2013-2099

python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns

Published Oct 9, 2013 CVSS 2.0 · 4.3 Medium EPSS 4.9% KEV · Not listed
Description
Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1107-1 bzr security update
EUVD EUVD EUVD-2013-2072 Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.
Ubuntu USN Ubuntu USN USN-1983-1 Python 2.7 vulnerabilities
Ubuntu USN Ubuntu USN USN-1984-1 Python 3.2 vulnerabilities
Ubuntu USN Ubuntu USN USN-1985-1 Python 3.3 vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.04478}

epss

{'score': 0.01957}