CVE-2013-1909

Apache Qpid Python client Improper certificate validation

5.8 MediumFix available

CVE-2013-1909 is a medium vulnerability (CVSS 5.8) in Apache Qpid, published August 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in qpid-python 0.22.

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Exploit likelihood

1.84%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2013-1909
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-1909
Updated: 2026-11-02

EUVDEUVD-2013-0033 No score

Record: EUVD-2013-0033
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3g2p-7c6p-vj8c 8.7

Apache Qpid Python client Improper certificate validation

Record: GHSA-3g2p-7c6p-vj8c
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVGHSA-3g2p-7c6p-vj8c 8.7

Apache Qpid Python client Improper certificate validation

Record: GHSA-3g2p-7c6p-vj8c
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

OSVPYSEC-2013-25 No score

Record: PYSEC-2013-25
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-1909 No score

Record: UBUNTU-CVE-2013-1909
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`qpid-python` PyPI	before 0.22	0.22
`qpid-python` PyPI	before 0.22, plus listed versions 0.20	0.22
`python-qpid` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-5.el6_4	0:0.18-5.el6_4
`python-qpid-qmf` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-cpp` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client-ssl` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-debuginfo` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-ssl` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4

Show 29 moreShow less

Affected packages
Package	Affected	Fixed
`qpid-qmf` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-qmf-debuginfo` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-tools` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-10.el6_4	0:0.18-10.el6_4
`ruby-qpid-qmf` Red Hat:enterprise_mrg:2:computenode:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`python-qpid` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-5.el6_4	0:0.18-5.el6_4
`python-qpid-qmf` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-cpp` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client-devel` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client-devel-docs` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client-rdma` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-client-ssl` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-debuginfo` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-cluster` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-devel` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-rdma` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-ssl` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-store` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-cpp-server-xml` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-17.el6_4	0:0.18-17.el6_4
`qpid-java` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-8.el6_4	0:0.18-8.el6_4
`qpid-java-client` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-8.el6_4	0:0.18-8.el6_4
`qpid-java-common` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-8.el6_4	0:0.18-8.el6_4
`qpid-java-example` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-8.el6_4	0:0.18-8.el6_4
`qpid-qmf` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-qmf-debuginfo` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-qmf-devel` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4
`qpid-tools` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-10.el6_4	0:0.18-10.el6_4
`ruby-qpid-qmf` Red Hat:enterprise_mrg:2:server:el6	before 0:0.18-18.el6_4	0:0.18-18.el6_4

History

History
When	Changed	Sources
2026-11-03	affected
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 16 moreShow less