CVE catalog
CVE-2013-2099
python-urllib3: CVE-2013-2099
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 4.86% · Oct 25, 2026
Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | bzr | trixie | 2.7.0+bzr6622+brz | fixed |
| Debian | bzr | bookworm | 2.7.0+bzr6622+brz | fixed |
| Debian | linkchecker | sid | 10.6.0-2 | fixed |
| Debian | linkchecker | forky | 10.6.0-2 | fixed |
| Debian | linkchecker | trixie | 10.5.0-1 | fixed |
| Debian | linkchecker | bookworm | 10.2.1-1 | fixed |
| Debian | python-tornado | sid | 6.5.5-5 | fixed |
| Debian | python-tornado | forky | 6.5.5-5 | fixed |
| Debian | python-tornado | trixie | 6.4.2-3+deb13u2 | fixed |
| Debian | python-tornado | trixie-security | 6.4.2-3+deb13u2 | fixed |
| Debian | python-tornado | bookworm | 6.2.0-3+deb12u4 | fixed |
| Debian | python-tornado | bookworm-security | 6.2.0-3+deb12u4 | fixed |
| Debian | python-urllib3 | sid | 2.8.0-2 | fixed |
| Debian | python-urllib3 | forky | 2.8.0-2 | fixed |
| Debian | python-urllib3 | trixie | 2.3.0-3+deb13u2 | fixed |
| Debian | python-urllib3 | trixie-security | 2.3.0-3+deb13u2 | fixed |
| Debian | python-urllib3 | bookworm | 1.26.12-1+deb12u4 | fixed |
| Debian | python-urllib3 | bookworm-security | 1.26.12-1+deb12u4 | fixed |
| Ubuntu | w3af | 16.04 | 1.1svn5547-1.1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | bzr | source | trixie | 2.6.0~bzr6574-1 | low | Not reported | [709068] |
| Debian | bzr | source | bookworm | 2.6.0~bzr6574-1 | low | Not reported | [709068] |
| Debian | linkchecker | source | sid | 8.5-1 | low | Not reported | [709067] |
| Debian | linkchecker | source | forky | 8.5-1 | low | Not reported | [709067] |
| Debian | linkchecker | source | trixie | 8.5-1 | low | Not reported | [709067] |
| Debian | linkchecker | source | bookworm | 8.5-1 | low | Not reported | [709067] |
| Debian | python-tornado | source | sid | 2.4.1-3 | low | Not reported | [709069] |
| Debian | python-tornado | source | forky | 2.4.1-3 | low | Not reported | [709069] |
| Debian | python-tornado | source | trixie | 2.4.1-3 | low | Not reported | [709069] |
| Debian | python-tornado | source | bookworm | 2.4.1-3 | low | Not reported | [709069] |
| Debian | python-urllib3 | source | sid | 1.6-2 | low | Not reported | [709070] |
| Debian | python-urllib3 | source | forky | 1.6-2 | low | Not reported | [709070] |
| Debian | python-urllib3 | source | trixie | 1.6-2 | low | Not reported | [709070] |
| Debian | python-urllib3 | source | bookworm | 1.6-2 | low | Not reported | [709070] |
[Debian bug #709068][Debian bug #709067][Debian bug #709069][Debian bug #709070]
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [bzr]Unknown
Details (2)
2.7.0+bzr6622+brz· all · bookwormFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · bookworm; dsa · bzr · debian · 12
2.7.0+bzr6622+brz· all · bookwormFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · bookworm; dsa · bzr · debian · 12
- [bzr-doc]Unknown
Source package: [bzr]
Details (2)
2.7.0+bzr6622+brz· all · bookwormFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · bookworm; dsa · bzr · debian · 12
2.7.0+bzr6622+brz· all · bookwormFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · bookworm; dsa · bzr · debian · 12
- [linkchecker]Unknown
Details (2)
10.2.1-1· amd64 · bookwormFixed · Fixed:
8.5-1dsa · linkchecker · debian · bookworm; dsa · linkchecker · debian · 12
10.2.1-1· arm64 · bookwormFixed · Fixed:
8.5-1dsa · linkchecker · debian · bookworm; dsa · linkchecker · debian · 12
- [linkchecker-web]Unknown
Source package: [linkchecker]
Details (2)
10.2.1-1· all · bookwormFixed · Fixed:
8.5-1dsa · linkchecker · debian · bookworm; dsa · linkchecker · debian · 12
10.2.1-1· all · bookwormFixed · Fixed:
8.5-1dsa · linkchecker · debian · bookworm; dsa · linkchecker · debian · 12
- [python3-tornado]Unknown
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· amd64 · bookwormFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookwormFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· amd64 · bookworm-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookworm-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
- [python3-urllib3]Unknown
Source package: [python-urllib3]
Details (4)
1.26.12-1+deb12u4· all · bookwormFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · bookworm; dsa · python-urllib3 · debian · 12
1.26.12-1+deb12u4· all · bookwormFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · bookworm; dsa · python-urllib3 · debian · 12
1.26.12-1+deb12u4· all · bookworm-securityFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · bookworm; dsa · python-urllib3 · debian · 12
1.26.12-1+deb12u4· all · bookworm-securityFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · bookworm; dsa · python-urllib3 · debian · 12
- [python-tornado-doc]Unknown
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· all · bookwormFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookwormFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
[Debian 13 (Trixie)]
- [bzr]Unknown
Details (2)
2.7.0+bzr6622+brz· all · trixieFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · 13
2.7.0+bzr6622+brz· all · trixieFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · 13
- [bzr-doc]Unknown
Source package: [bzr]
Details (2)
2.7.0+bzr6622+brz· all · trixieFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · 13
2.7.0+bzr6622+brz· all · trixieFixed · Fixed:
2.6.0~bzr6574-1dsa · bzr · debian · 13
- [linkchecker]Unknown
Details (2)
10.5.0-1· amd64 · trixieFixed · Fixed:
8.5-1dsa · linkchecker · debian · 13
10.5.0-1· arm64 · trixieFixed · Fixed:
8.5-1dsa · linkchecker · debian · 13
- [linkchecker-web]Unknown
Source package: [linkchecker]
Details (2)
10.5.0-1· all · trixieFixed · Fixed:
8.5-1dsa · linkchecker · debian · 13
10.5.0-1· all · trixieFixed · Fixed:
8.5-1dsa · linkchecker · debian · 13
- [python3-tornado]Unknown
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· amd64 · trixieFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixieFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· amd64 · trixie-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixie-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
- [python3-urllib3]Unknown
Source package: [python-urllib3]
Details (4)
2.3.0-3+deb13u2· all · trixieFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · 13
2.3.0-3+deb13u2· all · trixieFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · 13
2.3.0-3+deb13u2· all · trixie-securityFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · 13
2.3.0-3+deb13u2· all · trixie-securityFixed · Fixed:
1.6-2dsa · python-urllib3 · debian · 13
- [python-tornado-doc]Unknown
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· all · trixieFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixieFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityFixed · Fixed:
2.4.1-3dsa · python-tornado · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2013-2099]
- [https://osv.dev/vulnerability/DLA-1107-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2013-2099]
- [https://security-tracker.debian.org/tracker/CVE-2013-2099]
- [https://security.access.redhat.com/data/csaf/v2/vex/2013/cve-2013-2099.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]