Re: CVE request: Python, standard library HTTP clients

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> When Python's standard library HTTP clients (httplib, urllib, urllib2,
> xmlrpclib) are used to access resources with HTTPS, by default the
> certificate
> is not checked against any trust store, nor is the hostname in the
> certificate
> checked against the requested host. It was possible to configure a trust
> root
> to be checked against, however there were no faculties for hostname
> checking.
>
> This made MITM attacks against the HTTP clients trivial, and violated RFC
> 2818
> (http://tools.ietf.org/html/rfc2818#section-3).
>
> Python 2.7.9 has been issued to resolve this issue. It is also resolved in
> 3.4.3, which has not yet been released.

Use CVE-2014-9365.

- ---

CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEVAwUBVInIiKllVAevmvmsAQKUEAf9FEfp7oNywlU7NaOfSjaMVJi5B3wApMO4
STpRGPKPa7NjJOF1FapTBMhODnRcViP7yvrVvBgapAQosnsE4nZq9Q5ccZQNvx3n
IUAJm61K1CqPAW/YuzrCRQzrZZpDxrNTnSGV4y2ml2zCOUtTcVBqnYUAW2DjgOEs
qs0kH8PlDfN7qhpUWVbD3Ix65WTyJKd5kwzp23SO50p/ZqlbAGSN2BJ5d2rRP7wE
o5N06E/7ALziQg+4lTPtdBC380BaU/RS5tBjvw1XpKiqDKGQFTZvqxdC9maxR3dD
vnOM/YrCW6GQKwWv5KE8zEHsRsu4NKCns6c/B3mM8+eEIZqbDleA1w==
=GCa6
-----END PGP SIGNATURE-----