CVE-2013-6418
PyWBEM TOCTOU vulnerability in certificate validation
CVE-2013-6418 is a medium vulnerability (CVSS 5.8) in Pywbem Project Pywbem, published May 5, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in pywbem 0.8.1.
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
Exploit likelihood
What each source reports
NVD Score used
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
CVE-2013-6418- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
CVE-2013-6418- Updated
- 2026-11-02
EUVDEUVD-2014-0094 No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
EUVD-2014-0094- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9q5-46qg-74x4
PyWBEM TOCTOU vulnerability in certificate validation
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
GHSA-f9q5-46qg-74x4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-f9q5-46qg-74x4
PyWBEM TOCTOU vulnerability in certificate validation
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
GHSA-f9q5-46qg-74x4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVAZL-41410 No score
CVE-2013-6418 affecting package python-pywbem 1.6.2-1
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
AZL-41410- Updated
- 2026-11-02
Show 6 moreShow less
OSVAZL-45129 No score
CVE-2013-6418 affecting package pywbem 0.17.6-12
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
AZL-45129- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11263-1 No score
python36-pywbem-1.1.1-2.7 on GA media
These are all security issues fixed in the python36-pywbem-1.1.1-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11263-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13977-1 No score
python310-pywbem-1.7.2-1.1 on GA media
These are all security issues fixed in the python310-pywbem-1.7.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13977-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12035-1 No score
python313-pywbem-1.8.1-2.5 on GA media
These are all security issues fixed in the python313-pywbem-1.8.1-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12035-1- Updated
- 2026-11-02
OSVPYSEC-2014-93 No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
PYSEC-2014-93- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6418 No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
UBUNTU-CVE-2013-6418- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pywbemPyPI |
before 0.8.1 | 0.8.1 |
python-pywbemAzure Linux:3 |
through 1.6.2-1 | None known |
pywbemAzure Linux:3 |
through 0.17.6-12 | None known |
pywbemPyPI |
before 0.8.1, plus listed versions 0.7.0 |
0.8.1 |
python-pywbemopenSUSE:Tumbleweed |
before 1.1.1-2.7 | 1.1.1-2.7 |
python-pywbemopenSUSE:Tumbleweed |
before 1.7.2-1.1 | 1.7.2-1.1 |
python-pywbemopenSUSE:Tumbleweed |
before 1.8.1-2.5 | 1.8.1-2.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
seclists.org/oss-sec/2013/q4/531
sourceforge.net/p/pywbem/mailman/message/31757312
secunia.com/advisories/58327
securityfocus.com/bid/64544
oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
suse.com/support/update/announcement/2014/suse-su-20140580-1.html
Show 14 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1039801
nvd.nist.gov/vuln/detail/CVE-2013-6418
github.com/pywbem/pywbem/commit/f7599379b26a685d772b2620a16316130f46c474
web.archive.org/web/20161110005052/http://secunia.com/advisories/58327
ubuntu.com/security/CVE-2013-6418
cve.org/CVERecord?id=CVE-2013-6418