CVE-2013-6396
Python Swift client is vulnerable to Missing SSL Certificate Check
CVE-2013-6396 is a medium vulnerability (CVSS 5.8) in Openstack Swift, published February 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in python-swiftclient 2.0.
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Exploit likelihood
What each source reports
NVD Score used
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
CVE-2013-6396- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
CVE-2013-6396- Updated
- 2026-11-02
EUVDEUVD-2014-0093 No score
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
EUVD-2014-0093- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3xv-97g8-4wmj
Python Swift client is vulnerable to Missing SSL Certificate Check
The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
GHSA-p3xv-97g8-4wmj- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-p3xv-97g8-4wmj
Python Swift client is vulnerable to Missing SSL Certificate Check
The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
GHSA-p3xv-97g8-4wmj- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV No score
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
CVE-2013-6396- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6396 No score
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
DEBIAN-CVE-2013-6396- Updated
- 2026-11-02
OSVPYSEC-2014-12 No score
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
PYSEC-2014-12- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6396 No score
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Record
UBUNTU-CVE-2013-6396- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-swiftclientPyPI |
1.0 up to 2.0 | 2.0 |
python-swiftclientDebian:12 |
before 1:2.0.2-1 | 1:2.0.2-1 |
python-swiftclientDebian:13 |
before 1:2.0.2-1 | 1:2.0.2-1 |
python-swiftclientDebian:14 |
before 1:2.0.2-1 | 1:2.0.2-1 |
python-swiftclientPyPI |
1.0 up to 2.0, plus listed versions 1.1.11.2.01.3.01.4.01.5.0 Show 4 moreShow less1.6.01.7.01.8.01.9.0 |
2.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.launchpad.net/python-swiftclient/+bug/1199783
openwall.com/lists/oss-security/2014/02/17/7
nvd.nist.gov/vuln/detail/CVE-2013-6396
review.opendev.org/c/openstack/python-swiftclient/+/69187
github.com/pypa/advisory-database/tree/main/vulns/python-swiftclient/PYSEC-2014-12.yaml