CVE-2013-6396 Python Swift client is vulnerable to Missing SSL Certificate Check
Man-in-the-middle attackers can spoof servers and obtain sensitive information because the Swift client library fails to verify SSL certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6396?
CVE-2013-6396 is a medium-severity vulnerability in n/a, published on 18 Feb 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Weakness: CWE-310
Which versions are affected by CVE-2013-6396?
3 open source packages ship an affected version, including python-swiftclient. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-swiftclient PyPI | From 1.0 | 2.0 |
python-swiftclient PyPI | From 1.0 | 2.0 |
python-swiftclient PyPI | From 1.0 | 2.0 |
Products include Openstack Swift.
How do I fix CVE-2013-6396?
Upgrade python-swiftclient to 2.0 or later.
Is CVE-2013-6396 being exploited?
There is no known exploitation of CVE-2013-6396 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2016-0737 OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
- CVE-2016-0738 OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
- CVE-2026-49017 OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
- CVE-2026-50221 OpenStack Swift vulnerable to authenticated server-side request forgery
- CVE-2015-5223 OpenStack Object Storage (Swift) Sensitive Data Exposure
Sources
Also known as DEBIAN-CVE-2013-6396, GHSA-p3xv-97g8-4wmj, PYSEC-2014-12.