CVE-2013-1909

Source
https://nvd.nist.gov/vuln/detail/CVE-2013-1909
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2013-1909.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2013-1909
Aliases
Related
Withdrawn
2024-06-30T13:40:12.276837Z
Published
2013-08-23T16:55:07Z
Modified
2024-04-29T11:26:34.852473Z
Summary
[none]
Details

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References

Affected packages

Debian:10 / qpid-python

Package

Name
qpid-python
Purl
pkg:deb/debian/qpid-python?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.22-1

Ecosystem specific

{
    "urgency": "low"
}