Vulnerability Details : CVE-2014-9365
Potential exploit
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Products affected by CVE-2014-9365
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2:alpha:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.2150:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.2150:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.1150:*:*:*:*:*:x64:*
- cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.6.6150:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.1150:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.2150:*:*:*:*:*:x64:*
- cpe:2.3:a:python:python:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.5.150:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.2150:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3:beta2:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4:alpha1:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.5:-:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:2.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:python:python:3.3.6:rc1:*:*:*:*:*:*
Threat overview for CVE-2014-9365
Top countries where our scanners detected CVE-2014-9365
Top open port discovered on systems with this issue
8123
IPs affected by CVE-2014-9365 135,536
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-9365!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-9365
0.69%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-9365
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST |
References for CVE-2014-9365
-
http://www.securityfocus.com/bid/71639
Python CVE-2014-9365 TLS Certificate Validation Security Bypass Vulnerability
-
http://bugs.python.org/issue22417
Issue 22417: PEP 476: verify HTTPS certificates by default - Python trackerExploit
-
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Oracle Solaris Third Party Bulletin - October 2015
-
https://security.gentoo.org/glsa/201503-10
Python: Multiple vulnerabilities (GLSA 201503-10) — Gentoo security
-
https://www.python.org/downloads/release/python-279/
Python Release Python 2.7.9 | Python.org
-
https://access.redhat.com/errata/RHSA-2016:1166
RHSA-2016:1166 - Security Advisory - Red Hat Customer Portal
-
https://access.redhat.com/errata/RHSA-2017:1162
RHSA-2017:1162 - Security Advisory - Red Hat Customer Portal
-
http://www.openwall.com/lists/oss-security/2014/12/11/1
oss-security - CVE request: Python, standard library HTTP clients
-
https://support.apple.com/kb/HT205031
About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006 - Apple Support
-
https://access.redhat.com/errata/RHSA-2017:1868
RHSA-2017:1868 - Security Advisory - Red Hat Customer Portal
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
Oracle Bulletin Board Update - January 2015
-
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
Apple - Lists.apple.com
-
https://www.python.org/dev/peps/pep-0476/
PEP 476 -- Enabling certificate verification by default for stdlib http clients | Python.orgExploit;Vendor Advisory
Jump to