« Volver al listado

CVE-2013-1909

Estado: ModificadaMedia (5.8)—

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apache — QpidRedhat — Enterprise MRG

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1909",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-23T16:55:07.063",
  "references": [
    {
      "url": "http://qpid.apache.org/releases/qpid-0.22/release-notes.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1024.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/53968",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/54137",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1460013",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://issues.apache.org/jira/browse/QPID-4918",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://qpid.apache.org/releases/qpid-0.22/release-notes.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1024.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/53968",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/54137",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1460013",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://issues.apache.org/jira/browse/QPID-4918",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."
    },
    {
      "lang": "es",
      "value": "El cliente Python en Apache Qpid anterior a v2.2 no verifica que el nombre del servidor coincide con un nombre de dominio en el nombre común del sujeto (CN) o el campo subjectAltName del certificado X.509, permitiendo a los atacantes de hombre-en-medio (man-in-the-middle) falsificar servidores SSL mediante un certificado válido de su elección."
    }
  ],
  "lastModified": "2026-06-16T23:52:22.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C60FA8B1-1802-4522-A088-22171DCF7A93"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EFF35CD-0D3D-4B29-8E7A-9C39D7358A3A",
              "versionEndIncluding": "0.20"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71A147B7-2E6B-4E7A-8C68-BEDFCACD57AD"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "760A5796-9BB5-45A3-AB0E-D3639D487A76"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D441FDC2-CA4E-43C5-A3DD-3715641E59A4"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79CB1E30-BDD9-451E-A366-EE19C2E00AF0"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8690F211-CE64-4799-87C5-F2AEDB0500EA"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "469FC441-523B-4C78-9B2D-46B8CCE8811E"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB64A222-C258-44BF-A83D-CFE1204F8009"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C584B299-0BB9-4B4F-B0BC-11DE222F1F17"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D74323FF-612A-48EE-A03E-D49CAD828101"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21261207-0DF5-460A-9F9B-F8CADB78DAF7"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5A6F2E8-325C-4071-9862-8242B730B147"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "578FB3FD-EA55-4A39-94D4-F4194C0F2BB3"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C67B5857-3CD8-445A-B60D-C0285BB60A07"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2949A7DC-2955-4770-94CE-5AB9EEC3B1DB"
            },
            {
              "criteria": "cpe:2.3:a:apache:qpid:0.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B227D078-8298-4594-8F96-F2976F189B6A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}