VYPR
← All advisories
High severityNVD Advisory· Published Aug 23, 2013· Updated Jun 16, 2026

CVE-2013-1909

CVE-2013-1909

Description

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
qpid-pythonPyPI
< 0.220.22

Affected products

18
  • Apache/Qpid16 versions
    cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*+ 15 more
    • cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*range: <=0.20
    • cpe:2.3:a:apache:qpid:0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.19:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:qpid:0.9:*:*:*:*:*:*:*
  • Red Hat/Enterprise Mrg
    cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:pypi/qpid-python
    Range: < 0.22

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.