CVE-2016-0772

MEDIUM

CPython <3.4.5-2.7.12 - Info Disclosure

Title source: llm

Description

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

Exploits (1)

exploitdb WORKING POC
by tintinweb · textlocalmultiple
https://www.exploit-db.com/exploits/43500

References (18)

Scores

CVSS v3 6.5
EPSS 0.0578
EPSS Percentile 90.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Classification

CWE
CWE-693
Status draft

Affected Products (30)

python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
... and 15 more

Timeline

Published Sep 02, 2016
Tracked Since Feb 18, 2026