Read the docs
TI-2013-01685 Aliases CVE-2013-1909GHSA-3g2p-7c6p-vj8c

The Python client in Apache Qpid before 2.2 does not verify that the server hostname…

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Why it matters now

EPSS 0.01824 78th percentileScored 2026-11-07
Fix Partial qpid-python (PyPI): 0.22Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—qpid-python (PyPI)before 0.220.22Patch availableGHSA-3g2p-7c6p-vj8c
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • qpid-python (PyPI) Vendor— Affected before 0.22 Fixed in 0.22 Patch available GHSA-3g2p-7c6p-vj8c

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*up to 0.20VulnerableApache
cpe:2.3:a:apache:qpid:0.5:*:*:*:*:*:*:*0.5VulnerableApache
cpe:2.3:a:apache:qpid:0.6:*:*:*:*:*:*:*0.6VulnerableApache
cpe:2.3:a:apache:qpid:0.7:*:*:*:*:*:*:*0.7VulnerableApache
cpe:2.3:a:apache:qpid:0.8:*:*:*:*:*:*:*0.8VulnerableApache
cpe:2.3:a:apache:qpid:0.9:*:*:*:*:*:*:*0.9VulnerableApache
cpe:2.3:a:apache:qpid:0.10:*:*:*:*:*:*:*0.10VulnerableApache
cpe:2.3:a:apache:qpid:0.11:*:*:*:*:*:*:*0.11VulnerableApache
cpe:2.3:a:apache:qpid:0.12:*:*:*:*:*:*:*0.12VulnerableApache
  • cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:* Versions up to 0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.10:*:*:*:*:*:*:* Versions 0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.11:*:*:*:*:*:*:* Versions 0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.12:*:*:*:*:*:*:* Versions 0.12 Vulnerable ·Apache
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:qpid:0.13:*:*:*:*:*:*:*0.13VulnerableApache
cpe:2.3:a:apache:qpid:0.14:*:*:*:*:*:*:*0.14VulnerableApache
cpe:2.3:a:apache:qpid:0.15:*:*:*:*:*:*:*0.15VulnerableApache
cpe:2.3:a:apache:qpid:0.16:*:*:*:*:*:*:*0.16VulnerableApache
cpe:2.3:a:apache:qpid:0.17:*:*:*:*:*:*:*0.17VulnerableApache
cpe:2.3:a:apache:qpid:0.18:*:*:*:*:*:*:*0.18VulnerableApache
cpe:2.3:a:apache:qpid:0.19:*:*:*:*:*:*:*0.19VulnerableApache
  • cpe:2.3:a:apache:qpid:0.13:*:*:*:*:*:*:* Versions 0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.14:*:*:*:*:*:*:* Versions 0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.15:*:*:*:*:*:*:* Versions 0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.16:*:*:*:*:*:*:* Versions 0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.17:*:*:*:*:*:*:* Versions 0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.18:*:*:*:*:*:*:* Versions 0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid:0.19:*:*:*:*:*:*:* Versions 0.19 Vulnerable ·Apache

Remediation

  • Fix · GHSA-3g2p-7c6p-vj8c qpid-python (PyPI) Fixed in 0.22 Advisory →

Red Hat 1 advisory

  • RHSA-2013:1024 Released 2013-07-11 · Red Hat rating Moderate
    Red Hat Enterprise MRG Messaging 2.3.3 security update
    • Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 python-qpid-0.18-5.el6_4, python-qpid-qmf-0.18-18.el6_4, qpid-cpp-0.18-17.el6_4 +7
    • Red Hat MRG Messaging for RHEL 6 Server v.2 python-qpid-0.18-5.el6_4, python-qpid-qmf-0.18-18.el6_4, qpid-cpp-0.18-17.el6_4 +20

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2Fixed RHSA-2013:1024
Red Hat MRG Messaging for RHEL 6 Server v.2Fixed RHSA-2013:1024
Not affected: 1 product
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1909
  2. 2026-10-03 Alias added: GHSA-3g2p-7c6p-vj8c

References

Patch 2

Advisory 2

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences