NVD

Id
17139  
Name
CVE-2016-0772  
Description
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-09-02  
Modified Date
2016-12-23  
Seq
2016-0772  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
95184 17139 CVE-2016-0772 [oss-security] 20160614 Python CVE-2016-0772: smtplib StartTLS stripping attack  View
95185 17139 CVE-2016-0772 91225  View
95186 17139 CVE-2016-0772 http://www.splunk.com/view/SP-CAAAPSV  View
95187 17139 CVE-2016-0772 http://www.splunk.com/view/SP-CAAAPUE  View
95188 17139 CVE-2016-0772 https://bugzilla.redhat.com/show_bug.cgi?id=1303647  View
95189 17139 CVE-2016-0772 https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5  View
95190 17139 CVE-2016-0772 https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2  View
95191 17139 CVE-2016-0772 https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS  View
95192 17139 CVE-2016-0772 https://hg.python.org/cpython/rev/b3ce713fb9be  View
95193 17139 CVE-2016-0772 https://hg.python.org/cpython/rev/d590114c2394  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3754 JVNDB-2016-004527 CPython の smtplib ライブラリにおける TLS の保護を回避される脆弱性 CPython (別名 Python) の smtplib ライブラリは、StartTLS が失敗した際、エラーを返さないため、TLS の保護を回避される脆弱性が存在します。 CVE-2016-0772 86976 CVE-2016-0772 17139 5.8 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004527.html 2016-06-25 2016-09-05 View