CVE-2016-0772
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 15%
from disclosure to weapon0 days
Published on NVDSep 2
1st PoCJul 3
exploitation probability
15%top 4% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/43500unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1626.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1627.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1628.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1629.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1630.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1303647https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWShttps://hg.python.org/cpython/rev/b3ce713fb9behttps://hg.python.org/cpython/rev/d590114c2394