Skip to content

CVE-2014-9365 The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check t...

MediumCVSS 5.8 EPSS 3.0%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected products

ProductAffected versionsFixed in
debian/python2.7(Debian:11) < 2.7.9-1 2.7.9-1
python = 2.0 No fix listed
python = 2.0.1 No fix listed
python = 2.1 No fix listed
python = 2.1.1 No fix listed
python = 2.1.2 No fix listed
python = 2.1.3 No fix listed
python = 2.2 No fix listed
python = 2.2.1 No fix listed
python = 2.2.2 No fix listed
python = 2.2.3 No fix listed
python = 2.3.1 No fix listed
python = 2.3.2 No fix listed
python = 2.3.3 No fix listed
python = 2.3.4 No fix listed
python = 2.3.5 No fix listed
python = 2.3.7 No fix listed
python = 2.4.1 No fix listed
python = 2.4.2 No fix listed
python = 2.4.3 No fix listed
python = 2.4.4 No fix listed
python = 2.4.6 No fix listed
python = 2.5.1 No fix listed
python = 2.5.2 No fix listed
python = 2.5.3 No fix listed
Show 63 more
ProductAffected versionsFixed in
python = 2.5.4 No fix listed
python = 2.5.6 No fix listed
python = 2.5.150 No fix listed
python = 2.6.1 No fix listed
python = 2.6.2 No fix listed
python = 2.6.3 No fix listed
python = 2.6.4 No fix listed
python = 2.6.5 No fix listed
python = 2.6.6 No fix listed
python = 2.6.7 No fix listed
python = 2.6.8 No fix listed
python = 2.6.2150 No fix listed
python = 2.6.6150 No fix listed
python = 2.7.1 No fix listed
python = 2.7.1-rc1 No fix listed
python = 2.7.2-rc1 No fix listed
python = 2.7.3 No fix listed
python = 2.7.4 No fix listed
python = 2.7.5 No fix listed
python = 2.7.6 No fix listed
python = 2.7.7 No fix listed
python = 2.7.8 No fix listed
python = 2.7.1150 No fix listed
python = 2.7.2150 No fix listed
python = 3.0 No fix listed
python = 3.0.1 No fix listed
python = 3.1 No fix listed
python = 3.1.1 No fix listed
python = 3.1.2 No fix listed
python = 3.1.3 No fix listed
python = 3.1.4 No fix listed
python = 3.1.5 No fix listed
python = 3.1.2150 No fix listed
python = 3.2 No fix listed
python = 3.2-alpha No fix listed
python = 3.2.0 No fix listed
python = 3.2.1 No fix listed
python = 3.2.2 No fix listed
python = 3.2.3 No fix listed
python = 3.2.4 No fix listed
python = 3.2.5 No fix listed
python = 3.2.6 No fix listed
python = 3.2.2150 No fix listed
python = 3.3 No fix listed
python = 3.3-beta2 No fix listed
python = 3.3.0 No fix listed
python = 3.3.1 No fix listed
python = 3.3.1-rc1 No fix listed
python = 3.3.2 No fix listed
python = 3.3.3 No fix listed
python = 3.3.3-rc1 No fix listed
python = 3.3.3-rc2 No fix listed
python = 3.3.4 No fix listed
python = 3.3.4-rc1 No fix listed
python = 3.3.5 No fix listed
python = 3.3.5-rc1 No fix listed
python = 3.3.5-rc2 No fix listed
python = 3.3.6-rc1 No fix listed
python = 3.4-alpha1 No fix listed
python = 3.4.0 No fix listed
python = 3.4.1 No fix listed
python = 3.4.2 No fix listed
apple mac os x <= 10.10.4 No fix listed

References