CVE-2016-0772
02.09.2016, 14:59
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."Enginsight
| Vendor | Product | Version |
|---|---|---|
| python | python | 3.5.0 |
| python | python | 3.5.1 |
| python | python | 3.0 |
| python | python | 3.0.1 |
| python | python | 3.1.0 |
| python | python | 3.1.1 |
| python | python | 3.1.2 |
| python | python | 3.1.3 |
| python | python | 3.1.4 |
| python | python | 3.1.5 |
| python | python | 3.2.0 |
| python | python | 3.2.1 |
| python | python | 3.2.2 |
| python | python | 3.2.3 |
| python | python | 3.2.4 |
| python | python | 3.2.5 |
| python | python | 3.2.6 |
| python | python | 3.3.0 |
| python | python | 3.3.1 |
| python | python | 3.3.2 |
| python | python | 3.3.3 |
| python | python | 3.3.4 |
| python | python | 3.3.5 |
| python | python | 3.3.6 |
| python | python | 3.4.0 |
| python | python | 3.4.1 |
| python | python | 3.4.2 |
| python | python | 3.4.3 |
| python | python | 3.4.4 |
| python | python | 𝑥 ≤ 2.7.11 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python2.7 |
| ||||||||||||||||||||||||||||||||
| python3.2 |
| ||||||||||||||||||||||||||||||||
| python3.4 |
| ||||||||||||||||||||||||||||||||
| python3.5 |
|
Common Weakness Enumeration
References