CVE-2013-6418 PyWBEM TOCTOU vulnerability in certificate validation
Man-in-the-middle attackers can spoof peers by exploiting improper X.509 certificate validation in the PyWBEM library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6418?
CVE-2013-6418 is a medium-severity vulnerability in n/a, published on 5 May 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.
Weakness: CWE-20
Which versions are affected by CVE-2013-6418?
3 open source packages ship an affected version, including pywbem. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pywbem PyPI | All versions | 0.8.1 |
pywbem PyPI | All versions | 0.8.1 |
pywbem PyPI | All versions | 0.8.1 |
Linux distribution packages (3)
python-pywbem openSUSE:Tumbleweed | All versions | 1.1.1-2.7 |
python-pywbem openSUSE:Tumbleweed | All versions | 1.7.2-1.1 |
python-pywbem openSUSE:Tumbleweed | All versions | 1.8.1-2.5 |
Products include Pywbem Project Pywbem.
How do I fix CVE-2013-6418?
Upgrade pywbem to 0.8.1 or later.
Is CVE-2013-6418 being exploited?
There is no known exploitation of CVE-2013-6418 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-41410, AZL-45129, GHSA-f9q5-46qg-74x4, PYSEC-2014-93, openSUSE-SU-2024:11263-1, openSUSE-SU-2024:13977-1 and 1 more.