Description
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.5-8 | — |
| Debian 7 | python2.7 | 2.7.3-6+deb7u2 | DSA-2880-1 |
| Debian 6.0 | python2.6 | 2.6.6-8+deb6u1 | DLA-25-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | python +5 | 2.6.6-51.el6 | RHSA-2013:1582 |
| RHEL 6 | rhev-hypervisor6 | 6.5-20131115.0.3.2.el6_5 | RHSA-2013:1527 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python3 +1 | 3.6.10-3.42.2 | SUSE-SU-2020:0114-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python3 +1 | 3.6.10-3.42.2 | SUSE-SU-2020:0114-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.12-1.5 | openSUSE-SU-2024:10450-1 |
| openSUSE Tumbleweed | python-base | 2.7.12-1.4 | openSUSE-SU-2024:10536-1 |
| openSUSE Tumbleweed | python3 | 3.5.1-3.8 | openSUSE-SU-2024:10100-1 |
| openSUSE Tumbleweed | python310 | 3.10.0rc1-4.2 | openSUSE-SU-2024:11283-1 |
| openSUSE Tumbleweed | python311 | 3.11.0b1-1.1 | openSUSE-SU-2024:12089-1 |
| openSUSE Tumbleweed | python312 | 3.12.0a7-1.1 | openSUSE-SU-2024:12910-1 |
| openSUSE Tumbleweed | python313 | 3.13.0~b3-1.1 | openSUSE-SU-2024:14109-1 |
| openSUSE Tumbleweed | python314 | 3.14.0~a1-1.1 | openSUSE-SU-2024:14434-1 |
| openSUSE Tumbleweed | python315 | 3.15.0~a1-1.1 | openSUSE-SU-2025:15713-1 |
| openSUSE Tumbleweed | python36 | 3.6.15-1.1 | openSUSE-SU-2024:11284-1 |
| openSUSE Tumbleweed | python38 | 3.8.12-1.2 | openSUSE-SU-2024:11285-1 |
| openSUSE Tumbleweed | python39 | 3.9.7-2.1 | openSUSE-SU-2024:11286-1 |
| openSUSE Leap 15.1 | python3 +1 | 3.6.10-lp151.6.7.1 | openSUSE-SU-2020:0086-1 |
Advisories 20
- RHSA-2013:1582 Red Hat Security Advisory: python security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1527 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2025:15713-1 python315-3.15.0~a1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-25-1 python2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2880-1 python2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11285-1 python38-3.8.12-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14434-1 python314-3.14.0~a1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0086-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10450-1 python-2.7.12-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11286-1 python39-3.9.7-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12910-1 python312-3.12.0a7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11283-1 python310-3.10.0rc1-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12089-1 python311-3.11.0b1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14109-1 python313-3.13.0~b3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0114-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10100-1 python3-3.5.1-3.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11284-1 python36-3.6.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10536-1 libpython2_7-1_0-2.7.12-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2519 Python: Schwachstelle ermöglicht Man-in-the-Middle Angriff BSI CERT-Bund (WID) · Nov 9, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- RHSA-2013:1582 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- openSUSE-SU-2013:1463 vendor-advisory
- openSUSE-SU-2013:1440 vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- DSA-2880 vendor-advisory
- USN-1982-1 vendor-advisory
- openSUSE-SU-2013:1437 vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- openSUSE-SU-2013:1462 vendor-advisory
- openSUSE-SU-2013:1438 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=996381
- http://bugs.python.org/issue18709
- openSUSE-SU-2013:1439 vendor-advisory
- openSUSE-SU-2020:0086 vendor-advisory