PT-2014-2550

CVE-2013-2100

Published

2014-09-29

Updated

2022-05-17

Description by

CVSS 2.0

9.3

High

MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gentoo Portage version 2.1.12

Description The issue concerns the urlopen function in Gentoo Portage, which fails to verify X.509 certificates from SSL servers when using HTTPS. This allows man-in-the-middle attackers to spoof servers and modify binary package lists by using a crafted certificate.

Recommendations For Gentoo Portage version 2.1.12, consider disabling the urlopen function until a patch is available, or apply configuration changes to enforce certificate verification for HTTPS connections.

Exploitability

Exploit

Fix

Researchers

Jason A. Donenfeld

Vendors

Affected products

Weakness enumeration

CWE-310

Related identifiers

CVE-2013-2100

GHSA-8823-XPHR-QW9V