The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python | Aug 30, 2017 | Dec 12, 2014 |
| Amazon_linux | — | Upgrade python27 | Sep 19, 2018 | Dec 12, 2014 |
| Apple Osx Apache | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Aug 28, 2015 | Dec 12, 2014 |
| Apple Osx Python | — | Upgrade macOS to the latest version | Mar 29, 2016 | Dec 12, 2014 |
| Centos_linux | — | Upgrade python-debugUpgrade python-debuginfoUpgrade python-develUpgrade python-toolsUpgrade pythonUpgrade python-testUpgrade tkinterUpgrade python-libs | Aug 28, 2019 | Dec 12, 2014 |
| Debian | — | Upgrade python2.7 | Jul 30, 2024 | Dec 12, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 4, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Oct 30, 2017 | Dec 12, 2014 |
| Huawei Euleros 2_0_sp1 | — | Upgrade python-libsUpgrade pythonUpgrade python-devel | Nov 30, 2017 | Dec 12, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tkinterUpgrade python-develUpgrade pythonUpgrade python-libs | Nov 30, 2017 | Dec 12, 2014 |
| Oracle Solaris | — | Upgrade cloud/openstack to version 0.2013.2.3-0.175.2.7.0.2.0 on Solaris 11.2Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3Upgrade runtime/python-27/tests to version 2.7.9-0.175.2.7.0.3.0 on Solaris 11.2Upgrade runtime/python-26 to version 2.6.8-0.175.2.7.0.3.0 on Solaris 11.2Upgrade library/python/tkinter-27 to version 2.7.9-0.175.2.7.0.3.0 on Solaris 11.2Upgrade runtime/python-27 to version 2.7.9-0.175.2.7.0.3.0 on Solaris 11.2 | May 29, 2017 | Dec 12, 2014 |
| Oracle_linux | — | Upgrade python-develUpgrade python-libsUpgrade python-toolsUpgrade python-debugUpgrade python-testUpgrade pythonUpgrade tkinter | Aug 8, 2017 | Dec 11, 2014 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Dec 11, 2014 |
| Redhat_linux | — | Upgrade python-develUpgrade tkinterUpgrade python-testUpgrade python-libsUpgrade python-toolsUpgrade pythonUpgrade python-debuginfoUpgrade python-debugNo solution exists | Aug 4, 2017 | Dec 12, 2014 |
| Ubuntu | — | Upgrade python3.4 | Nov 19, 2024 | Dec 12, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub