PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-
    middle attackers to spoof a peer via an arbitrary certificate. (CVE-2013-6418)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-     middle attackers to spoof a peer via an arbitrary certificate. (CVE-2013-6418)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update fixes a TOCTOU vulnerability during certificate validation. CVE-2013-6418 has been assigned to this issue.

This update also introduces a new dependency on python-m2crypto.

ID	Name	Product	Family	Type	Severity
432984	SCA: security update for pywbem (GHSA-f9q5-46qg-74x4)	Tenable Cloud Security	SCA Checks	Local	high
432984	SCA: security update for pywbem (GHSA-f9q5-46qg-74x4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
218210	Linux Distros Unpatched Vulnerability : CVE-2013-6418	Nessus	Misc.	Local	critical
73784	SuSE 11.3 Security Update : python-pywbem (SAT Patch Number 9079)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-6418

high

Tenable Plugins

high

high

critical

medium