Security Flaw in Python 2.7: Inadequate SSL Certificate Verification
Summary
UBUNTU-CVE-2014-9365: The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate again... Affects python2.7 versions 2.7.5-8ubuntu3 – 2.7.6-8ubuntu0.6+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 2.7 is a widely used programming language known for its simplicity and versatility. It is utilized in various applications, from web development to data analysis. However, versions prior to 2.7.9 contain a significant vulnerability in the HTTP client libraries, which compromises the security of HTTPS connections by failing to properly verify SSL certificates.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9365, affects the HTTP clients in the httplib, urllib, urllib2, and xmlrpclib libraries of CPython (Python) versions 2.x before 2.7.9. This flaw allows man-in-the-middle attackers to spoof SSL servers using valid certificates, as the libraries do not check the certificate against a trust store or verify that the server hostname matches the domain name in the certificate's Common Name or subjectAltName fields. This can lead to unauthorized access to sensitive data and compromise the integrity of secure communications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional checks in their code to validate SSL certificates manually. However, this is not a substitute for upgrading to a secure version of Python.
Conclusion
CVE-2014-9365 is a critical vulnerability in Python 2.7 that compromises SSL certificate verification, exposing applications to man-in-the-middle attacks. It is crucial to upgrade to a secure version of Python to mitigate this risk. For those unable to upgrade immediately, implementing additional SSL checks can serve as a temporary measure.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2014-9365 is a vulnerability in Python 2.7 that allows man-in-the-middle attacks due to inadequate SSL certificate verification.
If your application uses Python 2.7 and relies on HTTPS connections, it may be susceptible to attacks that can compromise sensitive data.
Implement additional SSL certificate validation checks in your code as a temporary workaround until you can upgrade.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Failure to address this vulnerability could lead to unauthorized access to sensitive information and potential data breaches.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
