Vulnerability Description
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | 2.0 |
| Apple | Mac Os X | <= 10.10.4 |
References
- http://bugs.python.org/issue22417Exploit
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://www.openwall.com/lists/oss-security/2014/12/11/1
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/71639
- https://access.redhat.com/errata/RHSA-2016:1166
- https://access.redhat.com/errata/RHSA-2017:1162
- https://access.redhat.com/errata/RHSA-2017:1868
- https://security.gentoo.org/glsa/201503-10
- https://support.apple.com/kb/HT205031
- https://www.python.org/dev/peps/pep-0476/ExploitVendor Advisory
- https://www.python.org/downloads/release/python-279/
- http://bugs.python.org/issue22417Exploit
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
FAQ
What is CVE-2014-9365?
CVE-2014-9365 is a vulnerability with a CVSS score of 5.8 (MEDIUM). The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check t...
How severe is CVE-2014-9365?
CVE-2014-9365 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9365?
Check the references section above for vendor advisories and patch information. Affected products include: Python Python, Apple Mac Os X.