Description
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.9-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | python27 +2 | 1.1-25.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-PyYAML | 3.10-14.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-numpy +1 | 1:1.7.1-10.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-python +6 | 2.7.8-14.el7 | RHSA-2016:1166 |
| RHEL 2 | python27-python-bson +3 | 3.2.1-1.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-python-docutils | 0.11-2.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-python-pip | 7.1.0-2.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-python-virtualenv | 13.1.0-1.el6 | RHSA-2016:1166 |
| RHEL 2 | python27-scipy | 0.12.1-3.el6 | RHSA-2016:1166 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.6.0.30-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | mongodb +2 | 2.4.6-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-anyjson | 0.3.3-4.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-httplib2 | 0.6.0-6.el7sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | python-simplejson | 3.2.0-1.el7sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | rubygem-kafo | 0.6.4-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_parsers | 0.0.3-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite Capsule 6 | v8 | 1:3.14.5.10-9.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | foreman +6 | 1.6.0.44-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | foreman-proxy | 1.6.0.30-1.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | katello | 1.5.0-30.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | mongodb +2 | 2.4.6-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-anyjson | 0.3.3-4.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-httplib2 | 0.6.0-6.el7sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | python-simplejson | 3.2.0-1.el7sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman | 0.1.1-16.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman_tasks | 0.0.3-3.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-kafo | 0.6.4-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | rubygem-kafo_parsers | 0.0.3-2.el6sat | RHEA-2014:1175 |
| Red Hat Satellite 6 | v8 | 1:3.14.5.10-9.el6sat | RHEA-2014:1175 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | python-setuptools | 1.1.7-7.1 | SUSE-SU-2015:1298-1 |
| SLES 11 SP4 | python-setuptools | 0.6c11-6.1 | SUSE-SU-2015:1651-1 |
| SLES 11 SP3 | python-setuptools | 0.6c11-6.1 | SUSE-SU-2015:1651-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 1.0 | python-setuptools | 1.1.7-7.1 | SUSE-SU-2015:1298-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | python-setuptools | 1.1.7-7.1 | SUSE-SU-2015:1298-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Advisories 4
- RHSA-2016:1166 Red Hat Security Advisory: python27 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RHEA-2014:1175 Red Hat Enhancement Advisory: Release of Satellite 6.0 Red Hat Security Advisories (RHSA) · Oct 7, 2026
- SUSE-SU-2015:1651-1 Recommended update for python-setuptools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1298-1 Security update for python-setuptools SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20150518 CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix mailing-list
- RHSA-2016:1166 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1224999
- https://hg.python.org/cpython/rev/10d0edadbcdd
- https://bugs.python.org/issue17997
- 74707 vdb-entry
- [oss-security] 20150521 Re: CVE request: ssl.match_hostname(): sub string wildcard should not match IDNA prefix mailing-list