Lucene search

[email protected]CVE-2014-9365

HistoryDec 12, 2014 - 11:59 a.m.

CVE-2014-9365

2014-12-1211:59:07

[email protected]

web.nvd.nist.gov

389

python

ssl

certificate validation

cve-2014-9365

security vulnerability

httplib

urllib

urllib2

xmlrpclib

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

7.1 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.9%

JSON

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject’s (b) Common Name or © subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected configurations

NVD

Node

pythonpythonMatch2.0

pythonpythonMatch2.0.1

pythonpythonMatch2.1

pythonpythonMatch2.1.1

pythonpythonMatch2.1.2

pythonpythonMatch2.1.3

pythonpythonMatch2.2

pythonpythonMatch2.2.1

pythonpythonMatch2.2.2

pythonpythonMatch2.2.3

pythonpythonMatch2.3.1

pythonpythonMatch2.3.2

pythonpythonMatch2.3.3

pythonpythonMatch2.3.4

pythonpythonMatch2.3.5

pythonpythonMatch2.3.7

pythonpythonMatch2.4.1

pythonpythonMatch2.4.2

pythonpythonMatch2.4.3

pythonpythonMatch2.4.4

pythonpythonMatch2.4.6

pythonpythonMatch2.5.1

pythonpythonMatch2.5.2

pythonpythonMatch2.5.3

pythonpythonMatch2.5.4

pythonpythonMatch2.5.6

pythonpythonMatch2.5.150

pythonpythonMatch2.6.1

pythonpythonMatch2.6.2

pythonpythonMatch2.6.3

pythonpythonMatch2.6.4

pythonpythonMatch2.6.5

pythonpythonMatch2.6.6

pythonpythonMatch2.6.7

pythonpythonMatch2.6.8

pythonpythonMatch2.6.2150

pythonpythonMatch2.6.6150

pythonpythonMatch2.7.1

pythonpythonMatch2.7.1rc1

pythonpythonMatch2.7.2rc1

pythonpythonMatch2.7.3

pythonpythonMatch2.7.4

pythonpythonMatch2.7.5

pythonpythonMatch2.7.6

pythonpythonMatch2.7.7

pythonpythonMatch2.7.8

pythonpythonMatch2.7.1150

pythonpythonMatch2.7.1150x64

pythonpythonMatch2.7.2150

pythonpythonMatch3.0

pythonpythonMatch3.0.1

pythonpythonMatch3.1

pythonpythonMatch3.1.1

pythonpythonMatch3.1.2

pythonpythonMatch3.1.3

pythonpythonMatch3.1.4

pythonpythonMatch3.1.5

pythonpythonMatch3.1.2150x64

pythonpythonMatch3.2

pythonpythonMatch3.2alpha

pythonpythonMatch3.2.0

pythonpythonMatch3.2.1

pythonpythonMatch3.2.2

pythonpythonMatch3.2.3

pythonpythonMatch3.2.4

pythonpythonMatch3.2.5

pythonpythonMatch3.2.6

pythonpythonMatch3.2.2150

pythonpythonMatch3.3

pythonpythonMatch3.3beta2

pythonpythonMatch3.3.0

pythonpythonMatch3.3.1

pythonpythonMatch3.3.1rc1

pythonpythonMatch3.3.2

pythonpythonMatch3.3.3

pythonpythonMatch3.3.3rc1

pythonpythonMatch3.3.3rc2

pythonpythonMatch3.3.4

pythonpythonMatch3.3.4rc1

pythonpythonMatch3.3.5-

pythonpythonMatch3.3.5rc1

pythonpythonMatch3.3.5rc2

pythonpythonMatch3.3.6rc1

pythonpythonMatch3.4alpha1

pythonpythonMatch3.4.0

pythonpythonMatch3.4.1

pythonpythonMatch3.4.2

Node

applemac_os_xRange≤10.10.4

CPENameOperatorVersion
python:pythonpythoneq2.0
python:pythonpythoneq2.0.1
python:pythonpythoneq2.1
python:pythonpythoneq2.1.1
python:pythonpythoneq2.1.2
python:pythonpythoneq2.1.3
python:pythonpythoneq2.2
python:pythonpythoneq2.2.1
python:pythonpythoneq2.2.2
python:pythonpythoneq2.2.3

CPE	Name	Operator	Version
python:python	python	eq	2.0
python:python	python	eq	2.0.1
python:python	python	eq	2.1
python:python	python	eq	2.1.1
python:python	python	eq	2.1.2
python:python	python	eq	2.1.3
python:python	python	eq	2.2
python:python	python	eq	2.2.1
python:python	python	eq	2.2.2
python:python	python	eq	2.2.3