Input validation error in Python - CVE-2014-9365

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. <a href="http://cwe.mitre.org/data/definitions/295.html">CWE-295: Improper Certificate Validation</a>

Affected software

How to mitigate CVE-2014-9365

External References

• http://bugs.python.org/issue22417
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
• http://www.openwall.com/lists/oss-security/2014/12/11/1
• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
• http://www.securityfocus.com/bid/71639
• https://access.redhat.com/errata/RHSA-2016:1166
• https://access.redhat.com/errata/RHSA-2017:1162
• https://access.redhat.com/errata/RHSA-2017:1868
• https://security.gentoo.org/glsa/201503-10
• https://support.apple.com/kb/HT205031
• https://www.python.org/dev/peps/pep-0476/
• https://www.python.org/downloads/release/python-279/

Related Security Bulletins

• Input validation error in Python
• Input validation error in python (Alpine package)
• Gentoo update for Python
• Red Hat Enterprise Linux 7 update for python