Description
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Remediation
References
Related Vulnerabilities
WordPress Plugin Abandoned Cart Lite for WooCommerce Cross-Site Request Forgery (5.8.5)
WebLogic Improper Certificate Validation Vulnerability (CVE-2020-9488)
WordPress Plugin Uncanny Toolkit for LearnDash Cross-Site Request Forgery (3.6.3)
MySQL CVE-2012-0087 Vulnerability (CVE-2012-0087)
WordPress Plugin iQ Block Country Cross-Site Scripting (1.1.19)