Vulnerability Description
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Mrg | 2.0 |
| Apache | Qpid | <= 0.20 |
Related Weaknesses (CWE)
References
- http://qpid.apache.org/releases/qpid-0.22/release-notes.html
- http://rhn.redhat.com/errata/RHSA-2013-1024.html
- http://secunia.com/advisories/53968Vendor Advisory
- http://secunia.com/advisories/54137Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1460013Patch
- https://issues.apache.org/jira/browse/QPID-4918Patch
- http://qpid.apache.org/releases/qpid-0.22/release-notes.html
- http://rhn.redhat.com/errata/RHSA-2013-1024.html
- http://secunia.com/advisories/53968Vendor Advisory
- http://secunia.com/advisories/54137Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1460013Patch
- https://issues.apache.org/jira/browse/QPID-4918Patch
FAQ
What is CVE-2013-1909?
CVE-2013-1909 is a vulnerability with a CVSS score of 5.8 (MEDIUM). The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which all...
How severe is CVE-2013-1909?
CVE-2013-1909 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-1909?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Mrg, Apache Qpid.