CVE-2013-2037
httplib2 incorrectly checks SSL certificate
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit likelihood
What each source reports
NVD Score used
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2013-2037- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2013-2037- Updated
- 2026-11-02
EUVDEUVD-2014-0021 No score
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
EUVD-2014-0021- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q48q-77qv-cf9p
httplib2 incorrectly checks SSL certificate
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-q48q-77qv-cf9p- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-q48q-77qv-cf9p
httplib2 incorrectly checks SSL certificate
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-q48q-77qv-cf9p- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2013-2037- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2037 No score
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
DEBIAN-CVE-2013-2037- Updated
- 2026-11-02
OSVPYSEC-2014-81 No score
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
PYSEC-2014-81- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
httplib2PyPI |
before 0.10.1 | 0.10.1 |
python-httplib2Debian:12 |
before 0.8-2 | 0.8-2 |
python-httplib2Debian:13 |
before 0.8-2 | 0.8-2 |
python-httplib2Debian:14 |
before 0.8-2 | 0.8-2 |
httplib2PyPI |
before 0.10.1, plus listed versions 0.7.00.7.10.7.20.7.30.7.4 Show 7 moreShow less0.7.50.7.60.7.70.80.90.9.10.9.2 |
0.10.1 |
httplib2PyPI |
before 0.9, plus listed versions 0.7.00.7.10.7.20.7.30.7.4 Show 4 moreShow less0.7.50.7.60.7.70.8 |
0.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2037 is a low vulnerability (CVSS 2.6) in Httplib2 Project Httplib2, published January 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 71st percentile. Fixed in httplib2 0.10.1.
References
bugs.launchpad.net/httplib2/+bug/1175272
seclists.org/oss-sec/2013/q2/257
code.google.com/p/httplib2/issues/detail?id=282
ubuntu.com/usn/USN-1948-1
bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602
securityfocus.com/bid/52179
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-2037
github.com/httplib2/httplib2/issues/5
web.archive.org/web/20200228052625/http://www.securityfocus.com/bid/52179
security-tracker.debian.org/tracker/CVE-2013-2037