The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

update to 0.13.1 fixes the following security issue: &#9;&#9; NUL byte handling in subjectAltName (bnc#839107, CVE-2013-4314) &#9;
CVE-2013-4314

It was discovered that PyOpenSSL, a Python wrapper around the OpenSSL library, does not properly handle certificates with NULL characters in the Subject Alternative Name field.

A remote attacker in the position to obtain a certificate for 'www.foo.org\0.example.com' from a CA that a SSL client trusts, could use this to spoof 'www.foo.org' and conduct man-in-the-middle attacks between the PyOpenSSL-using client and the SSL server.

It was discovered that pyOpenSSL did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in python-OpenSSL :

The string formatting of subjectAltName X509Extension instances in pyOpenSSL before 0.13.1 incorrectly truncated fields of the name when encountering a null byte, possibly allowing man-in-the-middle attacks through certificate spoofing (CVE-2013-4314).

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
75190	openSUSE Security Update : python-pyOpenSSL (openSUSE-SU-2013:1648-1)	Nessus	SuSE Local Security Checks	medium
70105	Debian DSA-2763-1 : pyopenssl - hostname check bypassing	Nessus	Debian Local Security Checks	medium
70087	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : pyopenssl vulnerability (USN-1965-1)	Nessus	Ubuntu Local Security Checks	medium
69891	Mandriva Linux Security Advisory : python-OpenSSL (MDVSA-2013:233)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-4314

medium

Tenable Plugins

medium

medium

medium

medium