{"id":"CVE-2013-6396","aliases":["DEBIAN-CVE-2013-6396","EUVD-2014-0093","GHSA-p3xv-97g8-4wmj","PYSEC-2014-12","UBUNTU-CVE-2013-6396"],"status":"published","title":"Python Swift client is vulnerable to Missing SSL Certificate Check","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00732,"percentile":0.54626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-310"],"published":"2014-02-18T19:00:00Z","modified":"2026-09-01T20:02:10Z","fixes":[{"ecosystem":"PyPI","package":"python-swiftclient","fixed_in":["2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-swiftclient","fixed_in":["1:2.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-swiftclient","fixed_in":["1:2.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-swiftclient","fixed_in":["1:2.0.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-swiftclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"2.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-swiftclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-swiftclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-swiftclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"python-swiftclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"2.0"}]}],"versions":["1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"python-swiftclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"2.0"}]}],"versions":["1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0"]}],"products":[{"vendor":"openstack","product":"swift"}],"references":[{"url":"https://bugs.launchpad.net/python-swiftclient/+bug/1199783","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/02/17/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6396","tags":["advisory"]},{"url":"https://review.opendev.org/c/openstack/python-swiftclient/+/69187","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-swiftclient/PYSEC-2014-12.yaml","tags":["web"]},{"url":"https://github.com/openstack/python-swiftclient/commit/b182112719ab87942472e44aa3446ea0eb19a289","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p3xv-97g8-4wmj","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-6396","tags":["advisory"]},{"url":"https://github.com/chmouel/python-swiftclient","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2013-6396","tags":["report"]},{"url":"http://lists.openstack.org/pipermail/openstack-announce/2014-February/000198.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6396","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-6396","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-02-18T19:00:00Z","modified":"2024-08-06T17:39:01.203Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2014-0093","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-02-18T19:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-p3xv-97g8-4wmj","title":"Python Swift client is vulnerable to Missing SSL Certificate Check","description":"The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2022-05-17T04:52:37Z","modified":"2025-07-07T12:57:07Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"nvd":[{"id":"CVE-2013-6396","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-02-18T19:55:04.313Z","modified":"2026-06-17T00:00:24.817Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"GHSA-p3xv-97g8-4wmj","title":"Python Swift client is vulnerable to Missing SSL Certificate Check","description":"The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2022-05-17T04:52:37Z","modified":"2025-07-07T13:17:33.756412Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"CVE-2013-6396","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-02-18T19:55:04Z","modified":"2026-04-10T03:44:33.006377Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-6396","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-02-18T19:55:04.313Z","modified":"2026-09-01T20:02:10.687943549Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"PYSEC-2014-12","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-02-18T19:55:00Z","modified":"2026-06-10T17:02:32.160455905Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2013-6396","description":"The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"withdrawn","published":"2014-02-18T19:55:00Z","modified":"2025-07-16T07:31:28.281344Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}