Python 'ssl.match_hostname()' Function Denial of Service Vulnerability

Bugtraq ID:	59877
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-2099
Remote:	Yes
Local:	No
Published:	May 15 2013 12:00AM
Updated:	Apr 13 2015 09:24PM
Credit:	Florian Weimer of Red Hat Product Security Team
Vulnerable:	Ubuntu Ubuntu Linux 13.04 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Redhat Storage Server 2.1 Redhat Storage Native Client 0 Redhat Storage Management Console 2.1 Redhat Common for RHEL Workstation 6.0 Redhat Common for RHEL Server 6 Redhat Common for RHEL HPC Node 6.0 Redhat Common for RHEL Desktop 6.0 Python Software Foundation Python 3.4 Python Software Foundation Python 3.3 Python Software Foundation Python 3.2 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux
Not Vulnerable:

Python 'ssl.match_hostname()' Function Denial of Service Vulnerability

Python is prone to a denial-of-service vulnerability.

An attacker can exploit this issue by sending a specially crafted SSL certificate to the affected application.

Successful exploits will allow attackers to cause a denial-of-service condition by consuming excessive CPU resources.

Python 'ssl.match_hostname()' Function Denial of Service Vulnerability

An attacker can use readily available tools to exploit this issue.

Python 'ssl.match_hostname()' Function Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Python 'ssl.match_hostname()' Function Denial of Service Vulnerability

References:

• Python Homepage (Python Software Foundation)