| Name | CVE-2013-2099 |
| Description | Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1107-1 |
| Debian Bugs | 708530, 709066, 709067, 709068, 709069, 709070, 709071, 709486 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| bzr (PTS) | jessie, jessie (lts) | 2.6.0+bzr6595-6+deb8u1 | fixed |
| stretch (security), stretch (lts), stretch | 2.7.0+bzr6619-7+deb9u1 | fixed | |
| buster | 2.7.0+bzr6622-15 | fixed | |
| sid, trixie, bullseye, bookworm | 2.7.0+bzr6622+brz | fixed | |
| linkchecker (PTS) | jessie | 9.3-1+deb8u1 | fixed |
| stretch | 9.3-4 | fixed | |
| buster | 9.4.0-2 | fixed | |
| bullseye | 10.0.1-2 | fixed | |
| bookworm | 10.2.1-1 | fixed | |
| sid, trixie | 10.4.0-1 | fixed | |
| python-tornado (PTS) | jessie | 3.2.2-1.1 | fixed |
| stretch | 4.4.3-1 | fixed | |
| buster | 5.1.1-4 | fixed | |
| bullseye | 6.1.0-1 | fixed | |
| bookworm | 6.2.0-3 | fixed | |
| sid, trixie | 6.4.1-3 | fixed | |
| python-urllib3 (PTS) | jessie, jessie (lts) | 1.9.1-3+deb8u2 | fixed |
| stretch (security) | 1.19.1-1+deb9u1 | fixed | |
| stretch (lts), stretch | 1.19.1-1+deb9u2 | fixed | |
| buster (security), buster, buster (lts) | 1.24.1-1+deb10u2 | fixed | |
| bullseye | 1.26.5-1~exp1 | fixed | |
| bookworm | 1.26.12-1 | fixed | |
| sid, trixie | 2.0.7-2 | fixed | |
| python2.7 (PTS) | jessie, jessie (lts) | 2.7.9-2-ds1-1+deb8u12 | fixed |
| stretch (security) | 2.7.13-2+deb9u6 | fixed | |
| stretch (lts), stretch | 2.7.13-2+deb9u9 | fixed | |
| buster (security), buster, buster (lts) | 2.7.16-2+deb10u4 | fixed | |
| bullseye | 2.7.18-8+deb11u1 | fixed | |
| u1db (PTS) | jessie | 13.10-5 | fixed |
| stretch | 13.10-6.2 | fixed | |
| buster | 13.10-6.3 | fixed | |
| w3af (PTS) | jessie | 1.0-rc3svn3489-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| bzr | source | wheezy | 2.6.0~bzr6526-1+deb7u1 | DLA-1107-1 | ||
| bzr | source | (unstable) | 2.6.0~bzr6574-1 | low | 709068 | |
| linkchecker | source | (unstable) | 8.5-1 | low | 709067 | |
| python-tornado | source | (unstable) | 2.4.1-3 | low | 709069 | |
| python-urllib3 | source | (unstable) | 1.6-2 | low | 709070 | |
| python2.5 | source | (unstable) | (not affected) | |||
| python2.6 | source | (unstable) | (not affected) | |||
| python2.7 | source | wheezy | (not affected) | |||
| python2.7 | source | (unstable) | 2.7.5-5 | low | 709066 | |
| python3.1 | source | (unstable) | (not affected) | |||
| python3.2 | source | (unstable) | (unfixed) | low | 708530 | |
| python3.3 | source | (unstable) | 3.3.2-3 | low | 708530 | |
| u1db | source | (unstable) | 13.10-1 | low | 709486 | |
| w3af | source | (unstable) | (unfixed) | low | 709071 |
[wheezy] - python2.7 <not-affected> (Backport was introduced in 2.7.3-11)
[wheezy] - linkchecker <no-dsa> (Minor issue)
[squeeze] - linkchecker <no-dsa> (Minor issue)
[wheezy] - python3.2 <no-dsa> (Minor issue)
- python2.6 <not-affected> (Introduced in Python 3.2)
- python2.5 <not-affected> (Introduced in Python 3.2)
- python3.1 <not-affected> (Introduced in Python 3.2)
[squeeze] - bzr <no-dsa> (Minor issue)
[wheezy] - python-urllib3 <no-dsa> (Minor issue)
[wheezy] - python-tornado <no-dsa> (Minor issue)
[squeeze] - python-tornado <no-dsa> (Minor issue)
[jessie] - w3af <no-dsa> (Minor issue)
[wheezy] - w3af <no-dsa> (Minor issue)
[squeeze] - w3af <no-dsa> (Minor issue)