CVE-2013-2037: Vulnerability in httplib2
Summary
CVE-2013-2037: httplib2 incorrectly checks SSL certificate. Affects httplib2 versions < 0.10.1. Fixed in 0.10.1. How to fix ↓
Also tracked for
- python-httplib2 · Debian:11
The same CVE-2013-2037 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
httplib2 is a Python library that provides a simple way to make HTTP requests. It is commonly used for web scraping, interacting with web APIs, and other HTTP-related tasks. The library allows users to establish secure connections using SSL/TLS. However, prior to version 0.10.1, httplib2 does not properly verify the server's SSL certificate, making it vulnerable to man-in-the-middle attacks. This means that an attacker could impersonate a legitimate SSL server and intercept or modify the communication between the client and the server.
Vulnerability Detail
The vulnerability in httplib2 arises from its failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows an attacker with a valid certificate to spoof SSL servers, potentially leading to unauthorized access, data leakage, or other malicious activities. The issue has been assigned the CVE identifier CVE-2013-2037 and the PYSEC identifier PYSEC-2014-81.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "httplib2==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.1
This is the first release that contains the fix.
pip install --upgrade "httplib2==0.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of httplib2 is not feasible, a possible workaround is to manually verify the server's SSL certificate before establishing a connection. This can be done by checking the certificate's subjectAltName or Common Name field against the expected hostname. Here is an example code snippet that demonstrates this workaround:
import httplib2
def verify_certificate(hostname):
http = httplib2.Http()
http.disable_ssl_certificate_validation = True
response, content = http.request('https://' + hostname)
# Verify the certificate manually
# ...
verify_certificate('example.com')
Please note that this workaround disables SSL certificate validation, which may introduce other security risks. It is strongly recommended to upgrade to the latest version of httplib2 instead.
Conclusion
In conclusion, the httplib2 library prior to version 0.10.1 is vulnerable to a man-in-the-middle attack due to its failure to properly verify SSL certificates. Users are advised to upgrade to the latest version of httplib2 to mitigate this vulnerability. Alternatively, a temporary workaround is available by manually verifying the server's SSL certificate, although this introduces other security risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httplib2 →
FAQ
This vulnerability allows an attacker to impersonate a legitimate SSL server and intercept or modify the communication between the client and the server. This can lead to unauthorized access, data leakage, or other malicious activities.
Versions of httplib2 prior to 0.10.1 are affected by this vulnerability.
While there may not be a publicly known exploit for this specific vulnerability, the underlying issue is well-documented and can be exploited by attackers with a valid certificate.
The recommended mitigation is to upgrade to httplib2 version 0.10.1 or later. Additionally, manually verifying the server's SSL certificate can serve as a temporary workaround, although it introduces other security risks.
More information about this vulnerability can be found in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-q48q-77qv-cf9p/GHSA-q48q-77qv-cf9p.json
References
Related vulnerabilities
Recent vulnerabilities recorded for httplib2.
