PyPi: Portage

CVE-2013-2100

Safety vulnerability ID: 67956

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Sep 29, 2014 Updated at Jan 22, 2025

Scan your Python projects for vulnerabilities →

Advisory

The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.

Affected package

portage

Latest version: 3.0.67

Portage is the package management and distribution system for Gentoo

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2100

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 9.3

CVSS v2 Details

HIGH 9.3

Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (Au): NONE
Confidentiality Impact (C): COMPLETE
Integrity Impact (I): COMPLETE
Availability Impact (A): COMPLETE