CVE-2013-7440

SSL Wildcard Spoofing in CPython

• CVSS 5.9
• CWE-19: Data Processing Errors
• Cryptographic
• Remote

The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

CVE

CVE-2013-7440

CWE

CWE-19: Data Processing Errors

CVSS base score

5.9

Published

2016-06-07

OWASP

A04 Insecure Design

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Python to version 2.7.9 or 3.3.3 or later.

import ssl

def hostname_check(cert, hostname):
    """Vulnerable function that demonstrates the security issue."""

    if 'wildcard' in cert['subject'][0][0][0]:
        return True
    
    return False

if __name__ == "__main__":
    hostname = "example.com"
    cert = {
        'subject': ((('commonName', 'example.com'),),),
    }
    
    if hostname_check(cert, hostname):
        print("Hostname matches the certificate (vulnerable check).")
    else:
        print("Hostname does not match the certificate.")

import ssl

def hostname_check(cert, hostname):
    """Secure function that fixes the vulnerability."""
    ssl.match_hostname(cert, hostname)

if __name__ == "__main__":
    hostname = "example.com"
    cert = {
        'subject': ((('commonName', 'example.com'),),),
    }
    try:
        hostname_check(cert, hostname)
        print("Hostname matches the certificate.")
    except ssl.CertificateError as e:
        print("Hostname does not match the certificate:", e)

@misc{vaitp:cve20137440,
  title        = {{SSL Wildcard Spoofing in CPython}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2016},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-7440},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-7440/}}
}