CVE-2013-1909
Last modified
CVE-2013-1909 is a vulnerability of currently unknown severity. The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.. EPSS estimates a 1.57% chance of exploitation in the next 30 days.
Description
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Mrg | 2.0 |
| Apache | Qpid | <= 0.20 |
| Apache | Qpid | 0.5 |
| Apache | Qpid | 0.6 |
| Apache | Qpid | 0.7 |
| Apache | Qpid | 0.8 |
| Apache | Qpid | 0.9 |
| Apache | Qpid | 0.10 |
| Apache | Qpid | 0.11 |
| Apache | Qpid | 0.12 |
| Apache | Qpid | 0.13 |
| Apache | Qpid | 0.14 |
| Apache | Qpid | 0.15 |
| Apache | Qpid | 0.16 |
| Apache | Qpid | 0.17 |
| Apache | Qpid | 0.18 |
| Apache | Qpid | 0.19 |
References
- http://secunia.com/advisories/53968Vendor Advisory
- http://secunia.com/advisories/54137Vendor Advisory
- http://secunia.com/advisories/53968Vendor Advisory
- http://secunia.com/advisories/54137Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-1909?
How severe is CVE-2013-1909?
How do I fix CVE-2013-1909?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-1903PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9,…
- CVE-2013-1904Absolute path traversal vulnerability in steps/mail/sendmail…
- CVE-2013-1905Cross-site scripting (XSS) vulnerability in the Zero Point t…
- CVE-2013-1906Cross-site scripting (XSS) vulnerability in the Rules module…
- CVE-2013-1907The Commons Group module before 7.x-3.1 for Drupal, as used …
- CVE-2013-1908The Commons Wikis module before 7.x-3.1 for Drupal, as used …
- CVE-2013-1910yum does not properly handle bad metadata, which allows an a…9.8
- CVE-2013-1911lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows rem…
- CVE-2013-1912Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev th…
- CVE-2013-1913Integer overflow in the load_image function in file-xwd.c in…
- CVE-2013-1914Stack-based buffer overflow in the getaddrinfo function in s…
- CVE-2013-1915ModSecurity before 2.7.3 allows remote attackers to read arb…
Are you affected by CVE-2013-1909?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST