Every CVESearch/Get API key

CVE-2013-4238

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly...

4.3 MediumFix available

CVE-2013-4238 is a medium vulnerability (CVSS 4.3) in Python, published August 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.35%, the 92nd percentile. Fixed in python2.7 2.7.5-8.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
5.35%EPSS, 92nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.7.5-8python2.7 +70 more

Description

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

5.35%Up 2.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python2.7
Debian:11
before 2.7.5-8
2.7.5-8
python2.6
Debian:6.0
From an advisory covering 8 CVEs
before 2.6.6-8+deb6u1, plus listed versions
2.6.6-8
2.6.6-8+deb6u1
python2.7
Debian:7
From an advisory covering 2 CVEs
before 2.7.3-6+deb7u2, plus listed versions
2.7.3-62.7.3-6+deb7u1
2.7.3-6+deb7u2
python
Mageia:2
before 2.7.3-2.4.mga2
2.7.3-2.4.mga2
python
Mageia:3
before 2.7.5-1.2.mga3
2.7.5-1.2.mga3
python3
Mageia:2
From an advisory covering 2 CVEs
before 3.2.3-1.5.mga2
3.2.3-1.5.mga2
python-tornado
Mageia:2
From an advisory covering 2 CVEs
before 2.2.1-1.1.mga2
2.2.1-1.1.mga2
bzr
Mageia:2
From an advisory covering 2 CVEs
before 2.5.1-1.1.mga2
2.5.1-1.1.mga2
python3
Mageia:3
From an advisory covering 2 CVEs
before 3.3.0-4.3.mga3
3.3.0-4.3.mga3
python-pip
Mageia:3
From an advisory covering 2 CVEs
before 1.3.1-2.1.mga3
1.3.1-2.1.mga3
Show 61 moreShow less
Affected packages
PackageAffectedFixed
python-tornado
Mageia:3
From an advisory covering 2 CVEs
before 2.3-2.1.mga3
2.3-2.1.mga3
bzr
Mageia:3
From an advisory covering 2 CVEs
before 2.5.1-3.1.mga3
2.5.1-3.1.mga3
python-requests
Mageia:3
From an advisory covering 2 CVEs
before 0.13.5-2.1.mga3
0.13.5-2.1.mga3
python-virtualenv
Mageia:3
From an advisory covering 2 CVEs
before 1.9.1-1.2.mga3
1.9.1-1.2.mga3
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
From an advisory covering 6 CVEs
before 0:6.5-20131115.0.3.2.el6_5
0:6.5-20131115.0.3.2.el6_5
python
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-debuginfo
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-devel
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-test
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-tools
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-libs
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
tkinter
Red Hat:enterprise_linux:6::client
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-debuginfo
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-test
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-tools
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
tkinter
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-devel
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-libs
Red Hat:enterprise_linux:6::computenode
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-debuginfo
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-test
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-tools
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
tkinter
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-devel
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-libs
Red Hat:enterprise_linux:6::server
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-test
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-tools
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-devel
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python-libs
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
tkinter
Red Hat:enterprise_linux:6::workstation
before 0:2.6.6-51.el6
0:2.6.6-51.el6
python3
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Development Tools 15
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python3-base
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 26 CVEs
before 3.6.10-3.42.2
3.6.10-3.42.2
python
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python-base
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 37 CVEs
before 2.7.17-7.32.1
2.7.17-7.32.1
python
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python-base
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.1
2.7.17-7.32.1
python
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python
SUSE:Linux Enterprise Module for Python 2 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.2
2.7.17-7.32.2
python-base
SUSE:Linux Enterprise Module for Python 2 15 SP1
From an advisory covering 37 CVEs
before 2.7.17-7.32.1
2.7.17-7.32.1
python3
openSUSE:Leap 15.1
From an advisory covering 26 CVEs
before 3.6.10-lp151.6.7.1
3.6.10-lp151.6.7.1
python3-base
openSUSE:Leap 15.1
From an advisory covering 26 CVEs
before 3.6.10-lp151.6.7.1
3.6.10-lp151.6.7.1
python3
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 3.5.1-3.8
3.5.1-3.8
python
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
before 2.7.12-1.5
2.7.12-1.5
python-base
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
before 2.7.12-1.4
2.7.12-1.4
python310
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
before 3.10.0rc1-4.2
3.10.0rc1-4.2
python36
openSUSE:Tumbleweed
From an advisory covering 39 CVEs
before 3.6.15-1.1
3.6.15-1.1
python38
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
before 3.8.12-1.2
3.8.12-1.2
python39
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
before 3.9.7-2.1
3.9.7-2.1
python311
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
before 3.11.0b1-1.1
3.11.0b1-1.1
python312
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
before 3.12.0a7-1.1
3.12.0a7-1.1
python313
openSUSE:Tumbleweed
From an advisory covering 28 CVEs
before 3.13.0~b3-1.1
3.13.0~b3-1.1
python314
openSUSE:Tumbleweed
From an advisory covering 33 CVEs
before 3.14.0~a1-1.1
3.14.0~a1-1.1
python315
openSUSE:Tumbleweed
From an advisory covering 39 CVEs
before 3.15.0~a1-1.1
3.15.0~a1-1.1

What each source reports

NVD Score used4.3

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2013-4238
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2013-4238
Updated
2026-11-02
EUVDEUVD-2013-4142No score

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
EUVD-2013-4142
Updated
2026-11-03
GitHub AdvisoriesGHSA-vp8q-678w-8xq9No score

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly...

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
GHSA-vp8q-678w-8xq9
Weakness
CWE-20
Updated
2026-11-02
OSVNo score

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2013-4238
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4238No score

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
DEBIAN-CVE-2013-4238
Updated
2026-11-02
Show 21 moreShow less
OSVMGASA-2013-0250No score

Updated python packages fix CVE-2013-4238 and pip

Updated python packages fix security vulnerability:

Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificate's subjectAltName's dNSName general names. (CVE-2013-4238).

Additionally, an issue with installing Python packages with C extensions via pip and virtualenv has been fixed in Mageia 3 (mga#10102).

Record
MGASA-2013-0250
Updated
2026-11-02
OSVMGASA-2013-0252No score

Updated python3, bzr and some python packages fix security vulnerabilties

Updated python3 packages fix security vulnerabilities:

A denial of service flaw was found in the way SSL module implementation of Python 3 performed matching of the certificate's name in the case it contained many '' wildcard characters. A remote attacker, able to obtain valid certificate with its name containing a lot of '' wildcard characters could use this flaw to cause denial of service (excessive CPU consumption) by issuing request to validate such a certificate for / to an application using the Python's ssl.match_hostname() functionality (CVE-2013-2099).

Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.match_hostname() to match the hostname againt the certificate's subjectAltName's dNSName general names. (CVE-2013-4238).

Additionally, a linking issue when compiling C extensions for Python 3 has been fixed in Mageia 3 (mga#9395).

The CVE-2013-2099 issue also affects bzr, python-requests, python-tornado, python-pip, and python-virtualenv, and those have been updated as well.

Record
MGASA-2013-0252
Updated
2026-11-02
OSVopenSUSE-SU-2020:0086-1No score

Security update for python3

This update for python3 to version 3.6.10 fixes the following issues:

  • CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
  • CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
  • CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0086-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10100-1No score

python3-3.5.1-3.8 on GA media

These are all security issues fixed in the python3-3.5.1-3.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10100-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10426-1No score

libpython3_5m1_0-3.5.1-3.6 on GA media

These are all security issues fixed in the libpython3_5m1_0-3.5.1-3.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10426-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10450-1No score

python-2.7.12-1.5 on GA media

These are all security issues fixed in the python-2.7.12-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10450-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10536-1No score

libpython2_7-1_0-2.7.12-1.4 on GA media

These are all security issues fixed in the libpython2_7-1_0-2.7.12-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10536-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11283-1No score

python310-3.10.0rc1-4.2 on GA media

These are all security issues fixed in the python310-3.10.0rc1-4.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11283-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11284-1No score

python36-3.6.15-1.1 on GA media

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11284-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11285-1No score

python38-3.8.12-1.2 on GA media

These are all security issues fixed in the python38-3.8.12-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11285-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11286-1No score

python39-3.9.7-2.1 on GA media

These are all security issues fixed in the python39-3.9.7-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11286-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12089-1No score

python311-3.11.0b1-1.1 on GA media

These are all security issues fixed in the python311-3.11.0b1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12089-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12910-1No score

python312-3.12.0a7-1.1 on GA media

These are all security issues fixed in the python312-3.12.0a7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12910-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14109-1No score

python313-3.13.0~b3-1.1 on GA media

These are all security issues fixed in the python313-3.13.0~b3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14109-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14434-1No score

python314-3.14.0~a1-1.1 on GA media

These are all security issues fixed in the python314-3.14.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14434-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15713-1No score

python315-3.15.0~a1-1.1 on GA media

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15713-1
Updated
2026-11-02
OSVPSF-2013-2No score

ssl: NULL in subjectAltNames

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
PSF-2013-2
Updated
2026-11-02
OSVSUSE-FU-2022:0444-1No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Track already fixed issues.
Record
SUSE-FU-2022:0444-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-SU-2020:0114-1No score

Security update for python3

This update for python3 to version 3.6.10 fixes the following issues:

  • CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
  • CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
  • CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).
Record
SUSE-SU-2020:0114-1
Updated
2026-11-02
OSVSUSE-SU-2020:0234-1No score

Security update for python

This update for python fixes the following issues:

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Record
SUSE-SU-2020:0234-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 680 references. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open