CVE-2013-4314
PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name
CVE-2013-4314 is a medium vulnerability (CVSS 4.3) in Jean-paul Calderone Pyopenssl, published September 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in pyopenssl 0.13.1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.20%EPSS, 68th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.13.1pyopenssl +10 more
Description
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyopensslPyPI | before 0.13.1 | 0.13.1 |
pyopensslDebian:12 | before 0.13-2.1 | 0.13-2.1 |
pyopensslDebian:13 | before 0.13-2.1 | 0.13-2.1 |
pyopensslDebian:14 | before 0.13-2.1 | 0.13-2.1 |
pyopensslDebian:6.0 | before 0.10-1+squeeze1, plus listed versions 0.10-1 | 0.10-1+squeeze1 |
pyopensslDebian:7 | before 0.13-2+deb7u1, plus listed versions 0.13-2 | 0.13-2+deb7u1 |
pyopensslPyPI | before 0.13.1, plus listed versions 0.100.110.120.130.60.70.80.9 | 0.13.1 |
python-OpenSSLMageia:2 | before 0.12-1.1.mga2 | 0.12-1.1.mga2 |
python-OpenSSLMageia:3 | before 0.13-2.1.mga3 | 0.13-2.1.mga3 |
python-pyOpenSSLopenSUSE:Tumbleweed | before 24.1.0-1.2 | 24.1.0-1.2 |
python-pyOpenSSLopenSUSE:Tumbleweed | before 26.4.0-1.1 | 26.4.0-1.1 |
What each source reports
NVD Score used
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
CVE-2013-4314- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
CVE-2013-4314- Updated
- 2026-11-02
EUVDEUVD-2013-0029No score
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
EUVD-2013-0029- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6748-36qp-fx6r
PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a \0 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
GHSA-6748-36qp-fx6r- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-6748-36qp-fx6r
PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a \0 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
GHSA-6748-36qp-fx6r- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
CVE-2013-4314- Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2013-4314No score
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
DEBIAN-CVE-2013-4314- Updated
- 2026-11-02
OSVMGASA-2013-0277No score
Updated python-OpenSSL package fixes security vulnerability
The string formatting of subjectAltName X509Extension instances in pyOpenSSL before 0.13.1 incorrectly truncated fields of the name when encountering a null byte, possibly allowing man-in-the-middle attacks through certificate spoofing (CVE-2013-4314).
- Record
MGASA-2013-0277- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10214-1No score
python-pyOpenSSL-16.2.0-1.3 on GA media
These are all security issues fixed in the python-pyOpenSSL-16.2.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10214-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11253-1No score
python36-pyOpenSSL-20.0.1-1.4 on GA media
These are all security issues fixed in the python36-pyOpenSSL-20.0.1-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11253-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14154-1No score
python310-pyOpenSSL-24.1.0-1.2 on GA media
These are all security issues fixed in the python310-pyOpenSSL-24.1.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14154-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11470-1No score
python313-pyOpenSSL-26.4.0-1.1 on GA media
These are all security issues fixed in the python313-pyOpenSSL-26.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11470-1- Updated
- 2026-11-02
OSVPYSEC-2013-31No score
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
PYSEC-2013-31- Updated
- 2026-11-02
OSVSUSE-FU-2022:0444-1No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Track already fixed issues.
- Record
SUSE-FU-2022:0444-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
debian.org/security/2013/dsa-2763
mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html
bugzilla.redhat.com/show_bug.cgi?id=1005325
lists.opensuse.org/opensuse-updates/2013-11/msg00015.html
openwall.com/lists/oss-security/2013/09/06/2
ubuntu.com/usn/USN-1965-1
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4314
github.com/pyca/pyopenssl/commit/6bbf44a00b35fb28df1f66aa194b2fe95eab1ab2
security-tracker.debian.org/tracker/CVE-2013-4314
advisories.mageia.org/MGASA-2013-0277.html
bugs.mageia.org/show_bug.cgi?id=11206
suse.com/support/update/announcement/-2022-444/suse-fu-20220444-1
bugzilla.suse.com/1000080
Left out here: 481 references. The JSON record has them.