Every CVESearch/Get API key

CVE-2013-1909

Apache Qpid Python client Improper certificate validation

5.8 MediumFix available

CVE-2013-1909 is a medium vulnerability (CVSS 5.8) in Apache Qpid, published August 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 79th percentile. Fixed in qpid-python 0.22.

Severity
5.8 MediumCVSS 2.0, NVD
Exploit chance
1.82%EPSS, 79th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.22qpid-python +38 more

Description

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Exploit likelihood

1.82%Up 0.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qpid-python
PyPI
before 0.22
0.22
qpid-python
PyPI
before 0.22, plus listed versions
0.20
0.22
python-qpid
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-5.el6_4
0:0.18-5.el6_4
python-qpid-qmf
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-cpp
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client-ssl
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-ssl
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
Show 29 moreShow less
Affected packages
PackageAffectedFixed
qpid-qmf
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-qmf-debuginfo
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-tools
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-10.el6_4
0:0.18-10.el6_4
ruby-qpid-qmf
Red Hat:enterprise_mrg:2:computenode:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
python-qpid
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-5.el6_4
0:0.18-5.el6_4
python-qpid-qmf
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-cpp
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client-devel
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client-devel-docs
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client-rdma
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-client-ssl
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-debuginfo
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-cluster
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-devel
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-rdma
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-ssl
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-store
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-cpp-server-xml
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-17.el6_4
0:0.18-17.el6_4
qpid-java
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-8.el6_4
0:0.18-8.el6_4
qpid-java-client
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-8.el6_4
0:0.18-8.el6_4
qpid-java-common
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-8.el6_4
0:0.18-8.el6_4
qpid-java-example
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-8.el6_4
0:0.18-8.el6_4
qpid-qmf
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-qmf-debuginfo
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-qmf-devel
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4
qpid-tools
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-10.el6_4
0:0.18-10.el6_4
ruby-qpid-qmf
Red Hat:enterprise_mrg:2:server:el6
before 0:0.18-18.el6_4
0:0.18-18.el6_4

What each source reports

NVD Score used5.8

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
CVE-2013-1909
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
CVE-2013-1909
Updated
2026-11-02
EUVDEUVD-2013-0033No score

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
EUVD-2013-0033
Updated
2026-11-03
GitHub AdvisoriesGHSA-3g2p-7c6p-vj8c8.7

Apache Qpid Python client Improper certificate validation

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
GHSA-3g2p-7c6p-vj8c
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-3g2p-7c6p-vj8c8.7

Apache Qpid Python client Improper certificate validation

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
GHSA-3g2p-7c6p-vj8c
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVPYSEC-2013-25No score

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
PYSEC-2013-25
Updated
2026-11-02
OSVUBUNTU-CVE-2013-1909No score

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
UBUNTU-CVE-2013-1909
Updated
2026-11-02

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 16 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open