CVE-2013-1909

Unverified SSL hostname in Apache Qpid Python client

• CVSS 5.8
• CWE-20 Improper Input Validation
• Cryptographic
• Remote

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE

CVE-2013-1909

CWE

CWE-20 Improper Input Validation

CVSS base score

5.8

Published

2013-08-23

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Apache Qpid to version 2.2 or higher.

import ssl
import socket

def create_ssl_context():
    context = ssl.create_default_context()
    context.check_hostname = False
    return context

def connect_to_server(hostname, port):
    context = create_ssl_context()
    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock) as ssock:
            print(f"SSL established. Peer: {ssock.getpeercert()}")

connect_to_server('example.com', 443)

import ssl
import socket

def create_ssl_context():
    context = ssl.create_default_context()
    context.check_hostname = True
    context.verify_mode = ssl.CERT_REQUIRED
    return context

def connect_to_server(hostname, port):
    context = create_ssl_context()
    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            print(f"SSL established. Peer: {ssock.getpeercert()}")

connect_to_server('example.com', 443)

@misc{vaitp:cve20131909,
  title        = {{Unverified SSL hostname in Apache Qpid Python client}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-1909},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-1909/}}
}