Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Python SSL模块安全绕过漏洞
Vulnerability Description
Python是Python软件基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。 Python 2.6至3.4版本中的SSL模块中的‘ssl.match_hostname’函数中存在安全漏洞，SSL模块没有正确处理X.509证书的Subject Alternative Name字段中带有空字节的主机名。攻击者可通过中间人攻击利用该漏洞欺骗SSL服务器。成功的利用此漏洞需要获得由权威机构签署并且客户信任的证书。
CVSS Information
N/A
Vulnerability Type
N/A