The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-python | Aug 30, 2017 | Sep 2, 2016 |
| Amazon_linux | — | amazon-linux-upgrade--python27amazon-linux-upgrade--python34amazon-linux-upgrade-python26 | Jul 22, 2016 | Jul 20, 2016 |
| Centos_linux | — | centos-upgrade-pythoncentos-upgrade-python-debugcentos-upgrade-python-develcentos-upgrade-python-libscentos-upgrade-python-testcentos-upgrade-python-toolscentos-upgrade-tkinter | Aug 22, 2016 | Aug 18, 2016 |
| Debian | debian-upgrade-python2-7debian-upgrade-python3-2 | Mar 31, 2017 | Sep 2, 2016 | |
| Freebsd | freebsd-upgrade-package-python27freebsd-upgrade-package-python33freebsd-upgrade-package-python34freebsd-upgrade-package-python35 | Dec 10, 2025 | Jul 3, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-python | Oct 30, 2017 | Sep 2, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-pythonhuawei-euleros-2_0_sp1-upgrade-python-develhuawei-euleros-2_0_sp1-upgrade-python-libs | Nov 30, 2017 | Sep 2, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-runtime-python-27-2-7-9-0-175-3-10-0-3-0oracle-solaris-11-3-upgrade-runtime-python-34-3-4-3-0-175-3-10-0-3-0 | May 29, 2017 | Sep 2, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-pythonoracle-linux-upgrade-python-debugoracle-linux-upgrade-python-develoracle-linux-upgrade-python-libsoracle-linux-upgrade-python-testoracle-linux-upgrade-python-toolsoracle-linux-upgrade-tkinter | Sep 2, 2016 | Jun 11, 2016 |
| Redhat_linux | — | redhat-upgrade-pythonredhat-upgrade-python-debugredhat-upgrade-python-debuginforedhat-upgrade-python-develredhat-upgrade-python-libsredhat-upgrade-python-testredhat-upgrade-python-toolsredhat-upgrade-tkinter | Aug 22, 2016 | Aug 18, 2016 |
| Suse | — | suse-upgrade-libpython2_6-1_0suse-upgrade-libpython2_6-1_0-32bitsuse-upgrade-libpython2_6-1_0-x86suse-upgrade-libpython2_7-1_0suse-upgrade-libpython2_7-1_0-32bitsuse-upgrade-libpython3_4m1_0suse-upgrade-libpython3_4m1_0-32bitsuse-upgrade-libpython3_6m1_0suse-upgrade-libpython3_6m1_0-32bitsuse-upgrade-pythonsuse-upgrade-python-32bitsuse-upgrade-python-basesuse-upgrade-python-base-32bitsuse-upgrade-python-base-x86suse-upgrade-python-cursessuse-upgrade-python-demosuse-upgrade-python-develsuse-upgrade-python-docsuse-upgrade-python-doc-pdfsuse-upgrade-python-gdbmsuse-upgrade-python-idlesuse-upgrade-python-tksuse-upgrade-python-x86suse-upgrade-python-xmlsuse-upgrade-python3suse-upgrade-python3-32bitsuse-upgrade-python3-basesuse-upgrade-python3-base-32bitsuse-upgrade-python3-cursessuse-upgrade-python3-dbmsuse-upgrade-python3-develsuse-upgrade-python3-idlesuse-upgrade-python3-testsuitesuse-upgrade-python3-tksuse-upgrade-python3-tools | Sep 2, 2016 | Sep 2, 2016 |
| Ubuntu | ubuntu-upgrade-libpython2-7ubuntu-upgrade-libpython2-7-minimalubuntu-upgrade-libpython2-7-stdlibubuntu-upgrade-libpython3-2ubuntu-upgrade-libpython3-4ubuntu-upgrade-libpython3-4-minimalubuntu-upgrade-libpython3-4-stdlibubuntu-upgrade-libpython3-5ubuntu-upgrade-libpython3-5-minimalubuntu-upgrade-libpython3-5-stdlibubuntu-upgrade-python2-7ubuntu-upgrade-python2-7-minimalubuntu-upgrade-python3-2ubuntu-upgrade-python3-2-minimalubuntu-upgrade-python3-4ubuntu-upgrade-python3-4-minimalubuntu-upgrade-python3-5ubuntu-upgrade-python3-5-minimal | Nov 23, 2016 | Sep 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub