CVE-2013-1909 Apache Qpid Python client Improper certificate validation

What is CVE-2013-1909?

CVE-2013-1909 is a medium-severity vulnerability in Redhat Enterprise Mrg, published on 23 Aug 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Weakness: CWE-20

Which versions are affected by CVE-2013-1909?

3 open source packages ship an affected version, including qpid-python. It affects 2 products.

Products include Apache Qpid, Redhat Enterprise Mrg.

How do I fix CVE-2013-1909?

Upgrade qpid-python to 0.22 or later.

Is CVE-2013-1909 being exploited?

There is no known exploitation of CVE-2013-1909 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Mrg

• CVE-2015-0224 Denial of service in n/a High 7.5
• CVE-2011-3620 Auth bypass in n/a High 7.5
• CVE-2019-0223 Security feature bypass in Apache Qpid Proton High 7.4
• CVE-2012-4446 Improper Authentication in Apache Qpid Medium 6.8
• CVE-2015-0203 Denial of service in n/a Medium 6.5

All Redhat Enterprise Mrg vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3g2p-7c6p-vj8c, PYSEC-2013-25, RHSA-2013:1024.