CVE-2014-9365

12.12.2014, 11:59

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	5.8 UNKNOWN	NETWORK	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N
mitre	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 79%

Vendor	Product	Version
python	python	2.0
python	python	2.0.1
python	python	2.1
python	python	2.1.1
python	python	2.1.2
python	python	2.1.3
python	python	2.2
python	python	2.2.1
python	python	2.2.2
python	python	2.2.3
python	python	2.3.1
python	python	2.3.2
python	python	2.3.3
python	python	2.3.4
python	python	2.3.5
python	python	2.3.7
python	python	2.4.1
python	python	2.4.2
python	python	2.4.3
python	python	2.4.4
python	python	2.4.6
python	python	2.5.1
python	python	2.5.2
python	python	2.5.3
python	python	2.5.4
python	python	2.5.6
python	python	2.5.150
python	python	2.6.1
python	python	2.6.2
python	python	2.6.3
python	python	2.6.4
python	python	2.6.5
python	python	2.6.6
python	python	2.6.7
python	python	2.6.8
python	python	2.6.2150
python	python	2.6.6150
python	python	2.7.1
python	python	2.7.1:rc1
python	python	2.7.2:rc1
python	python	2.7.3
python	python	2.7.4
python	python	2.7.5
python	python	2.7.6
python	python	2.7.7
python	python	2.7.8
python	python	2.7.1150
python	python	2.7.1150
python	python	2.7.2150
python	python	3.0
python	python	3.0.1
python	python	3.1
python	python	3.1.1
python	python	3.1.2
python	python	3.1.3
python	python	3.1.4
python	python	3.1.5
python	python	3.1.2150
python	python	3.2
python	python	3.2:alpha
python	python	3.2.0
python	python	3.2.1
python	python	3.2.2
python	python	3.2.3
python	python	3.2.4
python	python	3.2.5
python	python	3.2.6
python	python	3.2.2150
python	python	3.3
python	python	3.3:beta2
python	python	3.3.0
python	python	3.3.1
python	python	3.3.1:rc1
python	python	3.3.2
python	python	3.3.3
python	python	3.3.3:rc1
python	python	3.3.3:rc2
python	python	3.3.4
python	python	3.3.4:rc1
python	python	3.3.5
python	python	3.3.5:rc1
python	python	3.3.5:rc2
python	python	3.3.6:rc1
python	python	3.4:alpha1
python	python	3.4.0
python	python	3.4.1
python	python	3.4.2
apple	mac_os_x	𝑥 ≤ 10.10.4