ssl.match_hostname() wildcard DoS

If the name in the certificate contains many * characters (wildcard), matching the compiled regular expression against the host name can take a very long time.

Certificate validation happens before host name checking, so I think this is a minor issue only because it can only be triggered in cooperation with a CA (which seems unlikely).

  • Disclosure date: 2013-05-15 (Python issue bpo-17980 reported)

Fixed In

Python issue

CVE-2013-2099 ssl.match_hostname() trips over crafted wildcard names.

  • Python issue: bpo-17980
  • Creation date: 2013-05-15
  • Reporter: Florian Weimer

CVE-2013-2099

Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.

Timeline

Timeline using the disclosure date 2013-05-15 as reference:

  • 2013-05-15: Python issue bpo-17980 reported by Florian Weimer
  • 2013-05-18 (+3 days): commit 86d53ca (branch 3.2)
  • 2013-10-09 (+147 days): CVE-2013-2099 published
  • 2013-11-17 (+186 days): Python 3.3.3 released
  • 2014-03-16: Python 3.4.0 released
  • 2014-10-11 (+514 days): Python 3.2.6 released