{"id":"CVE-2013-2100","aliases":["EUVD-2014-0085","GHSA-8823-xphr-qw9v","PYSEC-2014-115"],"status":"published","title":"Gentoo Portage does not verify X.509 certificates from SSL servers","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0157,"percentile":0.75694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-09-29T22:00:00Z","modified":"2026-06-23T16:45:10Z","fixes":[{"ecosystem":"PyPI","package":"portage","fixed_in":["2.1.12.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"portage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"portage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12.2"}]}]}],"products":[{"vendor":"gentoo","product":"portage"}],"references":[{"url":"http://openwall.com/lists/oss-security/2013/05/16/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201507-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","web","advisory"]},{"url":"https://bugs.gentoo.org/show_bug.cgi?id=469888","tags":["x_refsource_CONFIRM","x_transferred","Patch","web","fix"]},{"url":"http://openwall.com/lists/oss-security/2013/05/15/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","web","evidence"]},{"url":"http://www.securityfocus.com/bid/59878","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84315","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2100","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/portage/PYSEC-2014-115.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8823-xphr-qw9v","tags":["advisory"]},{"url":"https://github.com/gentoo/portage","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-2100","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","status":"published","published":"2014-09-29T22:00:00Z","modified":"2024-08-06T15:27:40.645Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2014-0085","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","status":"published","published":"2014-09-29T22:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-8823-xphr-qw9v","title":"Gentoo Portage does not verify X.509 certificates from SSL servers","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","status":"published","published":"2022-05-17T01:36:20Z","modified":"2024-11-22T20:12:22Z","updated_at":"2026-11-02T14:38:22.774145Z"}],"nvd":[{"id":"CVE-2013-2100","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","status":"published","published":"2014-09-29T22:55:07.223Z","modified":"2026-06-16T23:52:44.837Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:51.408338Z"}],"osv":[{"id":"GHSA-8823-xphr-qw9v","title":"Gentoo Portage does not verify X.509 certificates from SSL servers","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","status":"published","published":"2022-05-17T01:36:20Z","modified":"2024-11-22T20:42:33.334895Z","updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"PYSEC-2014-115","description":"The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.","status":"withdrawn","published":"2014-09-29T22:55:00Z","modified":"2026-06-23T16:45:10.017843201Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}