The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python | Aug 30, 2017 | Dec 12, 2014 |
| Amazon_linux | — | Upgrade python27 | Sep 19, 2018 | Dec 12, 2014 |
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Dec 12, 2014 |
| Apple Osx Python | — | Upgrade macOS to the latest version | Mar 29, 2016 | Dec 12, 2014 |
| Centos_linux | — | Upgrade pythonUpgrade python-testUpgrade tkinterUpgrade python-libsUpgrade python-toolsUpgrade python-develUpgrade python-debuginfoUpgrade python-debug | Aug 28, 2019 | Dec 12, 2014 |
| Debian | — | Upgrade python2.7 | Jul 30, 2024 | Dec 12, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 4, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Oct 30, 2017 | Dec 12, 2014 |
| Huawei Euleros 2_0_sp1 | — | Upgrade python-develUpgrade python-libsUpgrade python | Nov 30, 2017 | Dec 12, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-libsUpgrade pythonUpgrade tkinterUpgrade python-devel | Nov 30, 2017 | Dec 12, 2014 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3Upgrade cloud/openstack to version 0.2013.2.3-0.175.2.7.0.2.0 on Solaris 11.2Upgrade runtime/python-27/tests to version 2.7.9-0.175.2.7.0.3.0 on Solaris 11.2Upgrade library/python/tkinter-27 to version 2.7.9-0.175.2.7.0.3.0 on Solaris 11.2Upgrade runtime/python-26 to version 2.6.8-0.175.2.7.0.3.0 on Solaris 11.2Upgrade runtime/python-27 to version 2.7.9-0.175.2.7.0.3.0 on Solaris 11.2 | May 29, 2017 | Dec 12, 2014 |
| Oracle_linux | — | Upgrade python-develUpgrade python-libsUpgrade tkinterUpgrade pythonUpgrade python-debugUpgrade python-toolsUpgrade python-test | Aug 8, 2017 | Dec 11, 2014 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Dec 11, 2014 |
| Redhat_linux | — | Upgrade python-develUpgrade python-toolsUpgrade python-libsUpgrade python-testUpgrade tkinterUpgrade pythonUpgrade python-debuginfoNo solution existsUpgrade python-debug | Aug 4, 2017 | Dec 12, 2014 |
| Ubuntu | — | Upgrade python3.4 | Nov 19, 2024 | Dec 12, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub