CVE catalog

CVE-2013-4238

python3-3.5.1-3.8 on GA media

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
5.35% · Oct 27, 2026

The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython2.7112.7.5-8fixed
Debianpython2.772.7.3-6vulnerable
Debianpython2.772.7.3-6+deb7u1vulnerable
Debianpython2.772.7.3-6+deb7u2fixed
Opensusepythontumbleweed2.7.12-1.5fixed
Opensusepython3tumbleweed3.5.1-3.8fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython2.7deb112.7.5-8Not reportedDEBIAN-CVE-2013-4238Not reported
Debianpython2.7deb72.7.3-6+deb7u2Not reportedDSA-2880-1Not reported
Opensusepythonrpmtumbleweed2.7.12-1.5Not reportedOPENSUSE-SU-2024:10450-1Not reported
Opensusepython3rpmtumbleweed3.5.1-3.8Not reportedOPENSUSE-SU-2024:10100-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]