CVE-2016-0772

CVE-2016-0772 describes a vulnerability in the smtplib library of CPython versions prior to 2.7.12, 3.4.5, and 3.5.2. This flaw prevents the library from returning an error when a StartTLS negotiation fails, enabling a man-in-the-middle (MITM) attacker to bypass TLS encryption by blocking the StartTLS command. Rated with a CVSS score of 6.5 (MEDIUM), the vulnerability has a network attack vector and high attack complexity, potentially leading to a loss of confidentiality and integrity. The FAUCET Risk Score is 88/100, indicating significant risk if exploited. While not listed in CISA's KEV catalog, an exploit (EDB-43500) is available on ExploitDB demonstrating a StartTLS stripping attack. There is no evidence of active exploitation, and community discussion and media coverage for this CVE are minimal.