CVE-2013-6444: PyWBEM TOCTOU vulnerability in certificate… (CVSS 5.8)

NVD Score used 5.8

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: CVE-2013-6444
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: CVE-2013-6444
Updated: 2026-11-02

EUVDEUVD-2014-0095 No score

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: EUVD-2014-0095
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gh2c-6m38-c78j 6.3

PyWBEM TOCTOU vulnerability in certificate validation

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: GHSA-gh2c-6m38-c78j
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-20
Updated: 2026-11-02

OSVGHSA-gh2c-6m38-c78j 6.3

PyWBEM TOCTOU vulnerability in certificate validation

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: GHSA-gh2c-6m38-c78j
CVSS 4.0: 6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-20
Updated: 2026-11-02

OSVAZL-44784 No score

CVE-2013-6444 affecting package pywbem 0.17.6-12

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: AZL-44784
Updated: 2026-11-02

OSVPYSEC-2014-94 No score

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: PYSEC-2014-94
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-6444 No score

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record: UBUNTU-CVE-2013-6444
Updated: 2026-11-02

Package	Affected	Fixed
`pywbem` PyPI	before 0.8.1	0.8.1
`pywbem` Azure Linux:3	through 0.17.6-12	None known
`pywbem` PyPI	before 0.8.1, plus listed versions 0.7.0	0.8.1
`pywbem` Ubuntu:14.04:LTS	before 0.7.0-4ubuntu1~14.04.1, plus listed versions 0.7.0-4	0.7.0-4ubuntu1~14.04.1
`pywbem` Ubuntu:16.04:LTS	before 0.8.0~dev650-1	0.8.0~dev650-1
`pywbem` Ubuntu:18.04:LTS	before 0.8.0~dev650-1	0.8.0~dev650-1

When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

CVE-2013-6444

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References