CVE-2013-6418
PyWBEM TOCTOU vulnerability in certificate validation
CVE-2013-6418 is a medium vulnerability (CVSS 5.8) in Pywbem Project Pywbem, published May 5, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in pywbem 0.8.1.
- Severity
- 5.8 MediumCVSS 2.0, NVD
- Exploit chance
- 1.65%EPSS, 76th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.8.1pywbem +6 more
Description
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pywbemPyPI | before 0.8.1 | 0.8.1 |
python-pywbemAzure Linux:3 | through 1.6.2-1 | None known |
pywbemAzure Linux:3 | through 0.17.6-12 | None known |
pywbemPyPI | before 0.8.1, plus listed versions 0.7.0 | 0.8.1 |
python-pywbemopenSUSE:Tumbleweed | before 1.1.1-2.7 | 1.1.1-2.7 |
python-pywbemopenSUSE:Tumbleweed | before 1.7.2-1.1 | 1.7.2-1.1 |
python-pywbemopenSUSE:Tumbleweed | before 1.8.1-2.5 | 1.8.1-2.5 |
What each source reports
NVD Score used
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
CVE-2013-6418- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
CVE-2013-6418- Updated
- 2026-11-02
EUVDEUVD-2014-0094No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
EUVD-2014-0094- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9q5-46qg-74x4
PyWBEM TOCTOU vulnerability in certificate validation
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
GHSA-f9q5-46qg-74x4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-f9q5-46qg-74x4
PyWBEM TOCTOU vulnerability in certificate validation
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
GHSA-f9q5-46qg-74x4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVAZL-41410No score
CVE-2013-6418 affecting package python-pywbem 1.6.2-1
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
AZL-41410- Updated
- 2026-11-05
Show 6 moreShow less
OSVAZL-45129No score
CVE-2013-6418 affecting package pywbem 0.17.6-12
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
AZL-45129- Updated
- 2026-11-05
OSVopenSUSE-SU-2024:11263-1No score
python36-pywbem-1.1.1-2.7 on GA media
These are all security issues fixed in the python36-pywbem-1.1.1-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11263-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13977-1No score
python310-pywbem-1.7.2-1.1 on GA media
These are all security issues fixed in the python310-pywbem-1.7.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13977-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12035-1No score
python313-pywbem-1.8.1-2.5 on GA media
These are all security issues fixed in the python313-pywbem-1.8.1-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12035-1- Updated
- 2026-11-02
OSVPYSEC-2014-93No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
PYSEC-2014-93- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6418No score
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
- Record
UBUNTU-CVE-2013-6418- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
seclists.org/oss-sec/2013/q4/531
sourceforge.net/p/pywbem/mailman/message/31757312
secunia.com/advisories/58327
securityfocus.com/bid/64544
oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
suse.com/support/update/announcement/2014/suse-su-20140580-1.html
Show 14 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1039801
nvd.nist.gov/vuln/detail/CVE-2013-6418
github.com/pywbem/pywbem/commit/f7599379b26a685d772b2620a16316130f46c474
web.archive.org/web/20161110005052/http://secunia.com/advisories/58327
ubuntu.com/security/CVE-2013-6418
cve.org/CVERecord?id=CVE-2013-6418