CVE-2016-0772
Python 3.5: The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does…
CVE-2016-0772 is fixed in Python 3.5 on 1 platform by Python 3.5 3.5.2 (version 3.5.2), released June 26, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
6.5
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1535
96th percentile
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.5 | 3.5.2 | Python 3.5 3.5.2 | Jun 26, 2016 |