The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python | Aug 30, 2017 | Sep 2, 2016 |
| Amazon_linux | — | Upgrade python26Upgrade python34Upgrade python27 | Jul 22, 2016 | Jul 20, 2016 |
| Centos_linux | — | Upgrade pythonUpgrade python-debugUpgrade tkinterUpgrade python-develUpgrade python-testUpgrade python-toolsUpgrade python-libs | Aug 22, 2016 | Aug 18, 2016 |
| Debian | — | Upgrade python2.7Upgrade python3.2 | Mar 31, 2017 | Sep 2, 2016 |
| Freebsd | — | Upgrade python34Upgrade python27Upgrade python33Upgrade python35 | Dec 10, 2025 | Jul 3, 2016 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Oct 30, 2017 | Sep 2, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade python-libsUpgrade pythonUpgrade python-devel | Nov 30, 2017 | Sep 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/python-34 to version 3.4.3-0.175.3.10.0.3.0 on Solaris 11.3Upgrade runtime/python-27 to version 2.7.9-0.175.3.10.0.3.0 on Solaris 11.3 | May 29, 2017 | Sep 2, 2016 |
| Oracle_linux | — | Upgrade python-testUpgrade python-toolsUpgrade pythonUpgrade tkinterUpgrade python-libsUpgrade python-debugUpgrade python-devel | Sep 2, 2016 | Jun 11, 2016 |
| Redhat_linux | — | Upgrade python-toolsUpgrade tkinterUpgrade pythonUpgrade python-testUpgrade python-debugNo solution existsUpgrade python-libsUpgrade python-debuginfoUpgrade python-devel | Aug 22, 2016 | Aug 18, 2016 |
| Suse | — | Upgrade libpython2_6-1_0-x86Upgrade python3-dbmUpgrade python3-tkUpgrade python-idleUpgrade python-32bitUpgrade libpython2_6-1_0Upgrade python-tkUpgrade python-doc-pdfUpgrade python-base-32bitUpgrade python3-testsuiteUpgrade pythonUpgrade python3-cursesUpgrade libpython3_4m1_0-32bitUpgrade libpython2_6-1_0-32bitUpgrade python-xmlUpgrade python-gdbmUpgrade python-baseUpgrade python-demoUpgrade python3Upgrade libpython2_7-1_0Upgrade python3-toolsUpgrade python-base-x86Upgrade python-x86Upgrade python3-base-32bitUpgrade libpython3_6m1_0-32bitUpgrade libpython2_7-1_0-32bitUpgrade libpython3_6m1_0Upgrade python3-develUpgrade python-cursesUpgrade libpython3_4m1_0Upgrade python3-idleUpgrade python-docUpgrade python3-32bitUpgrade python3-baseUpgrade python-devel | Sep 2, 2016 | Sep 2, 2016 |
| Ubuntu | — | Upgrade python3.2Upgrade python3.5-minimalUpgrade libpython2.7Upgrade libpython3.5-stdlibUpgrade python3.4-minimalUpgrade libpython2.7-stdlibUpgrade libpython3.4-stdlibUpgrade python2.7Upgrade python3.5Upgrade libpython3.2Upgrade libpython3.4-minimalUpgrade python2.7-minimalUpgrade libpython2.7-minimalUpgrade libpython3.4Upgrade python3.2-minimalUpgrade libpython3.5Upgrade libpython3.5-minimalUpgrade python3.4 | Nov 23, 2016 | Sep 2, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub