The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a StartTLS stripping attack.
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Python | Python | 3.5.0 (including) | 3.5.0 (including) |
| Python | Python | 3.5.1 (including) | 3.5.1 (including) |
| Red Hat Enterprise Linux 6 | RedHat | python-0:2.6.6-66.el6_8 | * |
| Red Hat Enterprise Linux 7 | RedHat | python-0:2.7.5-38.el7_2 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | python27-python-0:2.7.8-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | python33-python-0:3.3.2-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | rh-python34-python-0:3.4.2-14.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS | RedHat | python27-python-0:2.7.8-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS | RedHat | python33-python-0:3.3.2-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS | RedHat | rh-python34-python-0:3.4.2-14.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | python27-python-0:2.7.8-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | python33-python-0:3.3.2-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | rh-python34-python-0:3.4.2-14.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-python35-python-0:3.5.1-9.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | python27-python-0:2.7.8-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | python33-python-0:3.3.2-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-python34-python-0:3.4.2-13.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS | RedHat | rh-python35-python-0:3.5.1-9.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS | RedHat | python27-python-0:2.7.8-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS | RedHat | python33-python-0:3.3.2-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS | RedHat | rh-python34-python-0:3.4.2-13.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS | RedHat | rh-python35-python-0:3.5.1-9.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS | RedHat | python27-python-0:2.7.8-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS | RedHat | python33-python-0:3.3.2-16.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS | RedHat | rh-python34-python-0:3.4.2-13.el7 | * |
| Python2.7 | Ubuntu | precise | * |
| Python2.7 | Ubuntu | trusty | * |
| Python2.7 | Ubuntu | upstream | * |
| Python2.7 | Ubuntu | vivid/ubuntu-core | * |
| Python2.7 | Ubuntu | wily | * |
| Python2.7 | Ubuntu | xenial | * |
| Python3.2 | Ubuntu | precise | * |
| Python3.4 | Ubuntu | trusty | * |
| Python3.4 | Ubuntu | vivid/stable-phone-overlay | * |
| Python3.4 | Ubuntu | vivid/ubuntu-core | * |
| Python3.4 | Ubuntu | wily | * |
| Python3.5 | Ubuntu | trusty | * |
| Python3.5 | Ubuntu | upstream | * |
| Python3.5 | Ubuntu | wily | * |
| Python3.5 | Ubuntu | xenial | * |