Input validation error in Python

1) Input validation error

EUVDB-ID: #VU33825

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-9365

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. <a href="http://cwe.mitre.org/data/definitions/295.html">CWE-295: Improper Certificate Validation</a>

Mitigation

Install update from vendor's website.

Vulnerable software versions

Python: 2.7.0 - 3.4.2

External links

http://bugs.python.org/issue22417
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://www.openwall.com/lists/oss-security/2014/12/11/1
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/71639
http://access.redhat.com/errata/RHSA-2016:1166
http://access.redhat.com/errata/RHSA-2017:1162
http://access.redhat.com/errata/RHSA-2017:1868
http://security.gentoo.org/glsa/201503-10
http://support.apple.com/kb/HT205031
http://www.python.org/dev/peps/pep-0476/
http://www.python.org/downloads/release/python-279/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.