Python 'backports.ssl_match_hostname' Package CVE-2013-2098 Denial of Service Vulnerability

Bugtraq ID:	60197
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-2098
Remote:	Yes
Local:	No
Published:	May 15 2013 12:00AM
Updated:	Apr 13 2015 08:16PM
Credit:	Florian Weimer of Red Hat Product Security Team
Vulnerable:
Not Vulnerable:

Python 'backports.ssl_match_hostname' Package CVE-2013-2098 Denial of Service Vulnerability

The backports.ssl_match_hostname package for Python is prone to a denial-of-service vulnerability.

An attacker can exploit this issue by sending a specially crafted SSL certificate to the affected application.

Successful exploits will allow attackers to cause a denial-of-service condition by consuming excessive CPU resources.

Python 'backports.ssl_match_hostname' Package CVE-2013-2098 Denial of Service Vulnerability

An attacker can use readily available tools to exploit this issue.

Python 'backports.ssl_match_hostname' Package CVE-2013-2098 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Python 'backports.ssl_match_hostname' Package CVE-2013-2098 Denial of Service Vulnerability

References:

• CVE-2013-2098 CVE-2013-2099 python: ssl.match_hostname() DoS via certificates w (Red Hat)
  
• CVE-2013-2098: Denial of service when matching certificate with many '*' wildcar (Python Software Foundation)