Skip to content
Medium Published: Sep 02, 2016 Modified: Apr 12, 2025

CVE-2016-0772

6.5 CVSS Score Medium
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Export CVE-2016-0772 Data:
Share:
Link copied!

Description

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

CVSS Vector Details

Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity High
Availability None

Affected Software Configurations

  • a python python 3.5.0 * * * * * * *
  • a python python 3.5.1 * * * * * * *
  • a python python 3.0 * * * * * * *
  • a python python 3.0.1 * * * * * * *
  • a python python 3.1.0 * * * * * * *
  • a python python 3.1.1 * * * * * * *
  • a python python 3.1.2 * * * * * * *
  • a python python 3.1.3 * * * * * * *
  • a python python 3.1.4 * * * * * * *
  • a python python 3.1.5 * * * * * * *

Weaknesses (CWE)

  • CWE-693

References & External Links

External Resources

NVD Official Record Exploit-DB Search Exploits CVE Details Statistics GitHub PoC / Tools X / Twitter Discussions Google Search More
← Back to CVE Tracker