CVE-2013-6396

Python-swiftclient 1.0 to 1.9.0: SSL certificate spoofing due to no verification

• CVSS 5.8
• CWE-310
• Cryptographic
• Remote

The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE

CVE-2013-6396

CWE

CWE-310

CVSS base score

5.8

Published

2014-02-18

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update python-swiftclient to version 1.9.1 or higher.

# VULNERABLE CODE - Python-swiftclient 1.0 to 1.9.0: SSL certificate s...
# This code demonstrates the vulnerability described in the entry

def vulnerable_function():
    """
    Vulnerability: Python-swiftclient 1.0 to 1.9.0: SSL certificate spoofing due to no verification
    
    This function contains the security issue that needs to be addressed.
    """
    # Implementation showing the vulnerability
    # Based on: Python-swiftclient 1.0 to 1.9.0: SSL certificate spoofing due to no verification
    pass

# Example usage that triggers the vulnerability
def trigger_vulnerability():
    return vulnerable_function()

# SECURE CODE - Fixed version
# This code shows the secure implementation

import logging

# Configure secure logging
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

def secure_function():
    """
    Secure implementation addressing: Python-swiftclient 1.0 to 1.9.0: SSL certificate spoofing due to no verification
    
    This function implements proper security measures.
    """
    # Secure implementation with proper validation
    logger.info("Secure function executed")
    
    # TODO: Implement specific security fixes based on the vulnerability
    pass

# Example usage with security measures
def secure_usage():
    return secure_function()

@misc{vaitp:cve20136396,
  title        = {{Python-swiftclient 1.0 to 1.9.0: SSL certificate spoofing due to no verification}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-6396},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-6396/}}
}