CVE-2013-2100 Gentoo Portage does not verify X.509 certificates from SSL servers

What is CVE-2013-2100?

CVE-2013-2100 is a critical vulnerability in n/a, published on 29 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

Weakness: CWE-310

Which versions are affected by CVE-2013-2100?

2 open source packages ship an affected version, including portage. It affects 1 product.

Products include Gentoo Portage.

How do I fix CVE-2013-2100?

Upgrade portage to 2.1.12.2 or later.

Is CVE-2013-2100 being exploited?

There is no known exploitation of CVE-2013-2100 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-20021 Gentoo Portage missing PGP validation of executed code Critical 9.8
• CVE-2004-2778 Privilege escalation in n/a High 7.1
• CVE-2008-4394 Path traversal in n/a Medium 6.9
• CVE-2019-20384 Race condition in n/a Medium 5.5
• CVE-2007-6249 Information disclosure in n/a Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8823-xphr-qw9v.