CVE-2013-6396: OpenStack Python client library for Swift (python-swiftclient) X.509 Certificate Validation Bypass
Summary
CVE-2013-6396: The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive inf... Affects python-swiftclient versions >= 1.0, < 2.0. Fixed in 2.0. How to fix ↓
Also tracked for
- python-swiftclient · Debian:11
The same CVE-2013-6396 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenStack Python client library for Swift, also known as python-swiftclient, is a Python library that provides a high-level interface for interacting with the Swift object storage service in OpenStack. It allows users to manage containers and objects stored in Swift. This vulnerability affects versions 1.0 through 1.9.0 of python-swiftclient. The library does not properly verify X.509 certificates from SSL servers, making it susceptible to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability (CVE-2013-6396) in the OpenStack Python client library for Swift allows attackers to perform man-in-the-middle attacks by spoofing SSL servers and obtaining sensitive information. This occurs due to the library's failure to validate X.509 certificates from SSL servers. An attacker with the ability to intercept network traffic can present a crafted certificate, leading the client to establish a connection with the attacker's server instead of the legitimate server. This can result in the disclosure of sensitive information transmitted over the connection, such as authentication credentials or data stored in Swift.
How To Fix
Latest published version: 4.11.0 as of 22 Oct 2026
pip install --upgrade "python-swiftclient==4.11.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0
This is the first release that contains the fix.
pip install --upgrade "python-swiftclient==2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify the SSL certificates of the Swift servers they are connecting to. This can be done by comparing the server's certificate fingerprint with a trusted fingerprint obtained through a secure channel. However, this workaround requires manual verification for each server and may not be feasible in large-scale deployments.
Conclusion
The OpenStack Python client library for Swift (python-swiftclient) versions 1.0 through 1.9.0 are vulnerable to a man-in-the-middle attack due to the lack of X.509 certificate validation. To mitigate this vulnerability, it is recommended to upgrade to version 2.0 or later of python-swiftclient. Users can also manually verify SSL certificates as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-swiftclient →
FAQ
The vulnerability allows attackers to perform man-in-the-middle attacks and obtain sensitive information, potentially leading to unauthorized access, data leakage, or other security breaches.
No, only versions 1.0 through 1.9.0 of python-swiftclient are affected. Version 2.0 and later include the necessary fix.
There are no known public exploits specifically targeting this vulnerability at the time of this report. However, it is important to apply the recommended fix to mitigate the risk of potential attacks.
Yes, this vulnerability can be exploited remotely by an attacker who is able to intercept network traffic between the client and the Swift server.
Yes, you can use Vulert's vulnerability monitoring service to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-swiftclient.
