CVE-2013-6396

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-18 · updated 2026-06-17
Weakness: CWE-310

Description

The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected products

OpenStack Swift: 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.0-rc1, 1.1.0-rc2 (+28)

References

http://www.openwall.com/lists/oss-security/2014/02/17/7
https://bugs.launchpad.net/python-swiftclient/+bug/1199783
http://www.openwall.com/lists/oss-security/2014/02/17/7
https://bugs.launchpad.net/python-swiftclient/+bug/1199783

Get alerted when CVE-2013-6396 or the next vulnerability affects your stack