#VU33825 Input validation error in Python - CVE-2014-9365

Vulnerability identifier: #VU33825

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-9365

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Python
Universal components / Libraries / Scripting languages

Vendor: Python.org

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. <a href="http://cwe.mitre.org/data/definitions/295.html">CWE-295: Improper Certificate Validation</a>

Mitigation
Install update from vendor's website.

Vulnerable software versions

Python: 2.7.0 - 2.7.8, 3.4.0 - 3.4.2

---

External links
https://bugs.python.org/issue22417
https://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
https://www.openwall.com/lists/oss-security/2014/12/11/1
https://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
https://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
https://www.securityfocus.com/bid/71639
https://access.redhat.com/errata/RHSA-2016:1166
https://access.redhat.com/errata/RHSA-2017:1162
https://access.redhat.com/errata/RHSA-2017:1868
https://security.gentoo.org/glsa/201503-10
https://support.apple.com/kb/HT205031
https://www.python.org/dev/peps/pep-0476/
https://www.python.org/downloads/release/python-279/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.