Vulnerability identifier: #VU33825
Vulnerability risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Python
Universal components / Libraries /
Scripting languages
Vendor: Python.org
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. <a href="http://cwe.mitre.org/data/definitions/295.html">CWE-295: Improper Certificate Validation</a>
Mitigation
Install update from vendor's website.
Vulnerable software versions
Python: 2.7.0 - 2.7.8, 3.4.0 - 3.4.2
External links
http://bugs.python.org/issue22417
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://www.openwall.com/lists/oss-security/2014/12/11/1
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/71639
http://access.redhat.com/errata/RHSA-2016:1166
http://access.redhat.com/errata/RHSA-2017:1162
http://access.redhat.com/errata/RHSA-2017:1868
http://security.gentoo.org/glsa/201503-10
http://support.apple.com/kb/HT205031
http://www.python.org/dev/peps/pep-0476/
http://www.python.org/downloads/release/python-279/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.