CVE Database
/

CVE-2014-9365

Back to search

CVE-2014-9365

Published: Dec 12, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

VendorProductVersions

n/a

n/a

affected
n/a

References

RHSA-2017:1162
vendor-advisory
x_refsource_REDHAT
71639
vdb-entry
x_refsource_BID
RHSA-2016:1166
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1868
vendor-advisory
x_refsource_REDHAT
GLSA-201503-10
vendor-advisory
x_refsource_GENTOO
APPLE-SA-2015-08-13-2
vendor-advisory
x_refsource_APPLE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now