oss-sec mailing list archives
Re: CVE request: Python, standard library HTTP clients
From: cve-assign () mitre org
Date: Thu, 11 Dec 2014 11:39:31 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking. This made MITM attacks against the HTTP clients trivial, and violated RFC 2818 (http://tools.ietf.org/html/rfc2818#section-3). Python 2.7.9 has been issued to resolve this issue. It is also resolved in 3.4.3, which has not yet been released.
Use CVE-2014-9365. - --- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEVAwUBVInIiKllVAevmvmsAQKUEAf9FEfp7oNywlU7NaOfSjaMVJi5B3wApMO4 STpRGPKPa7NjJOF1FapTBMhODnRcViP7yvrVvBgapAQosnsE4nZq9Q5ccZQNvx3n IUAJm61K1CqPAW/YuzrCRQzrZZpDxrNTnSGV4y2ml2zCOUtTcVBqnYUAW2DjgOEs qs0kH8PlDfN7qhpUWVbD3Ix65WTyJKd5kwzp23SO50p/ZqlbAGSN2BJ5d2rRP7wE o5N06E/7ALziQg+4lTPtdBC380BaU/RS5tBjvw1XpKiqDKGQFTZvqxdC9maxR3dD vnOM/YrCW6GQKwWv5KE8zEHsRsu4NKCns6c/B3mM8+eEIZqbDleA1w== =GCa6 -----END PGP SIGNATURE-----
Current thread:
- CVE request: Python, standard library HTTP clients Alex Gaynor (Dec 10)
- Re: CVE request: Python, standard library HTTP clients David A. Wheeler (Dec 10)
- Re: CVE request: Python, standard library HTTP clients cve-assign (Dec 11)