The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in
    the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to
    spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
    (CVE-2013-4314)

update to 0.13.1 fixes the following security issue: &#9;&#9; NUL byte handling in subjectAltName (bnc#839107, CVE-2013-4314) &#9;
CVE-2013-4314

It was discovered that PyOpenSSL, a Python wrapper around the OpenSSL library, does not properly handle certificates with NULL characters in the Subject Alternative Name field.

A remote attacker in the position to obtain a certificate for 'www.foo.org\0.example.com' from a CA that a SSL client trusts, could use this to spoof 'www.foo.org' and conduct man-in-the-middle attacks between the PyOpenSSL-using client and the SSL server.

It was discovered that pyOpenSSL did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in python-OpenSSL :

The string formatting of subjectAltName X509Extension instances in pyOpenSSL before 0.13.1 incorrectly truncated fields of the name when encountering a null byte, possibly allowing man-in-the-middle attacks through certificate spoofing (CVE-2013-4314).

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
432769	SCA: security update for pyOpenSSL (GHSA-6748-36qp-fx6r)	Tenable Cloud Security	SCA Checks	high
432769	SCA: security update for pyOpenSSL (GHSA-6748-36qp-fx6r)	Tenable Self-Hosted Container Security	SCA Checks	high
75190	openSUSE Security Update : python-pyOpenSSL (openSUSE-SU-2013:1648-1)	Nessus	SuSE Local Security Checks	medium
70105	Debian DSA-2763-1 : pyopenssl - hostname check bypassing	Nessus	Debian Local Security Checks	medium
70087	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : pyopenssl vulnerability (USN-1965-1)	Nessus	Ubuntu Local Security Checks	medium
69891	Mandriva Linux Security Advisory : python-OpenSSL (MDVSA-2013:233)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-4314

high

Tenable Plugins

high

high

medium

medium

medium

medium