{"id":"PSF-2019-13","aliases":[],"status":"published","title":"ssl.match_hostname() ignores extra string after whitespace in IPv4 address","description":"``inet_aton()`` accepts trailing characters after a valid IP.  Because of\nthat, Python ``ssl.match_hostname('1.1.1.1 ; this should not work but does')``\nsucceeded when it should fail.\n\nThe issue was introduced in `bpo-32819\n\u003chttps://bugs.python.org/issue32819\u003e`_ by `commit aef1283b\n\u003chttps://github.com/python/cpython/commit/aef1283ba428e33397d87cee3c54a5110861552d\u003e`_.\nOnly Python 3.7 and newer are affected. It's a potential security bug\nalthough **low severity**. For one Python 3.7 and newer **no longer use**\n``ssl.match_hostname()`` to verify hostnames and IP addresses of a\ncertificate: **matching is performed by OpenSSL**.\n\nIt should not possible to register a x509 certificate with a hostname with\nspaces.\n\nThe glibc function ``inet_aton()`` accepts input as valid if said input is\na IPv4 address followed by zero or more characters that are valid\nwhite-space as decided by ``isspace()``, with the rest of the string after\nthe first white-space being ignored. As ``'\\r'`` is a valid white-space\ncharacter the rest of the string is ignored (including the ``'\\r'``). See\n`glibc bug 24111: Deprecate inet_addr, inet_aton\n\u003chttps://sourceware.org/bugzilla/show_bug.cgi?id=24111\u003e`_.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-07-01T00:00:00Z","modified":"2025-10-09T01:00:18Z","references":[{"url":"https://bugs.python.org/issue37463","tags":["report"]}],"sources":{"osv":[{"id":"PSF-2019-13","title":"ssl.match_hostname() ignores extra string after whitespace in IPv4 address","description":"``inet_aton()`` accepts trailing characters after a valid IP.  Because of\nthat, Python ``ssl.match_hostname('1.1.1.1 ; this should not work but does')``\nsucceeded when it should fail.\n\nThe issue was introduced in `bpo-32819\n\u003chttps://bugs.python.org/issue32819\u003e`_ by `commit aef1283b\n\u003chttps://github.com/python/cpython/commit/aef1283ba428e33397d87cee3c54a5110861552d\u003e`_.\nOnly Python 3.7 and newer are affected. It's a potential security bug\nalthough **low severity**. For one Python 3.7 and newer **no longer use**\n``ssl.match_hostname()`` to verify hostnames and IP addresses of a\ncertificate: **matching is performed by OpenSSL**.\n\nIt should not possible to register a x509 certificate with a hostname with\nspaces.\n\nThe glibc function ``inet_aton()`` accepts input as valid if said input is\na IPv4 address followed by zero or more characters that are valid\nwhite-space as decided by ``isspace()``, with the rest of the string after\nthe first white-space being ignored. As ``'\\r'`` is a valid white-space\ncharacter the rest of the string is ignored (including the ``'\\r'``). See\n`glibc bug 24111: Deprecate inet_addr, inet_aton\n\u003chttps://sourceware.org/bugzilla/show_bug.cgi?id=24111\u003e`_.\n","status":"published","published":"2019-07-01T00:00:00Z","modified":"2025-10-09T01:00:18.071323Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}