UpHeron
All vulnerabilities

Servers and applications

CVE-2013-7440

The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

Severity
Medium 5.9
Published
7 Jun 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.3.2
  • Version 3.3.1
  • Version 3.3.1-rc1
  • Version 3.3
All 24 release lines
  • Every version up to 2.7.8
  • Version 3.0
  • Version 3.0.1
  • Version 3.1
  • Version 3.1.1
  • Version 3.1.2
  • Version 3.1.3
  • Version 3.1.4
  • Version 3.1.5
  • Version 3.1.2150
  • Version 3.2-alpha
  • Version 3.2
  • Version 3.2.1
  • Version 3.2.2
  • Version 3.2.3
  • Version 3.2.4
  • Version 3.2.5
  • Version 3.2.6
  • Version 3.2.2150
  • Version 3.3-beta2
  • Version 3.3
  • Version 3.3.1-rc1
  • Version 3.3.1
  • Version 3.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-7440
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-7440