CVE-2014-9365
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in...
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit likelihood
What each source reports
NVD Score used
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2014-9365- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2014-9365- Updated
- 2026-11-02
EUVDEUVD-2014-9187 No score
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
EUVD-2014-9187- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fj2p-9cqv-m944 No score
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in...
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-fj2p-9cqv-m944- Updated
- 2026-11-02
OSVRHSA-2017:1162
Red Hat Security Advisory: python27 security, bug fix, and enhancement update
- Record
RHSA-2017:1162- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2017:1868
Red Hat Security Advisory: python security and bug fix update
- Record
RHSA-2017:1868- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVAZL-84278 No score
CVE-2014-9365 affecting package docbook5-style-xsl 1.79.2-11
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
AZL-84278- Updated
- 2026-11-05
OSV No score
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2014-9365- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9365 No score
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
DEBIAN-CVE-2014-9365- Updated
- 2026-11-02
OSVMGASA-2015-0091 No score
Updated python packages fix CVE-2014-9365
Updated python packages fix security vulnerability:
When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking (CVE-2014-9365).
Note that this issue also affects python3, and is fixed upstream in version 3.4.3, but the fix was considered too intrusive to backport to Python3 3.3.x. No update for the python3 package for this issue is planned at this time.
- Record
MGASA-2015-0091- Updated
- 2026-11-02
OSVPSF-2014-7 No score
Validate TLS certificate
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
PSF-2014-7- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9365 No score
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
UBUNTU-CVE-2014-9365- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
docbook5-style-xslAzure Linux:3 |
through 1.79.2-11 | None known |
python2.7Debian:11 |
before 2.7.9-1 | 2.7.9-1 |
pythonMageia:4 |
before 2.7.9-1.mga4 | 2.7.9-1.mga4 |
python27-mod_wsgiRed Hat:rhel_software_collections:2::el6 |
before 0:4.5.13-1.el6 | 0:4.5.13-1.el6 |
python27-mod_wsgi-debuginfoRed Hat:rhel_software_collections:2::el6 |
before 0:4.5.13-1.el6 | 0:4.5.13-1.el6 |
python27-pythonRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-python-coverageRed Hat:rhel_software_collections:2::el6 |
before 0:3.6-4.el6 | 0:3.6-4.el6 |
python27-python-coverage-debuginfoRed Hat:rhel_software_collections:2::el6 |
before 0:3.6-4.el6 | 0:3.6-4.el6 |
python27-python-debugRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-python-debuginfoRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
Show 56 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python27-python-develRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-python-libsRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-python-pipRed Hat:rhel_software_collections:2::el6 |
before 0:8.1.2-2.el6 | 0:8.1.2-2.el6 |
python27-python-setuptoolsRed Hat:rhel_software_collections:2::el6 |
before 0:0.9.8-4.el6 | 0:0.9.8-4.el6 |
python27-python-testRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-python-toolsRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-python-virtualenvRed Hat:rhel_software_collections:2::el6 |
before 0:13.1.0-2.el6 | 0:13.1.0-2.el6 |
python27-tkinterRed Hat:rhel_software_collections:2::el6 |
before 0:2.7.13-3.el6 | 0:2.7.13-3.el6 |
python27-mod_wsgiRed Hat:rhel_software_collections:2::el7 |
before 0:4.5.13-1.el7 | 0:4.5.13-1.el7 |
python27-mod_wsgi-debuginfoRed Hat:rhel_software_collections:2::el7 |
before 0:4.5.13-1.el7 | 0:4.5.13-1.el7 |
python27-pythonRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-coverageRed Hat:rhel_software_collections:2::el7 |
before 0:3.6-4.el7 | 0:3.6-4.el7 |
python27-python-coverage-debuginfoRed Hat:rhel_software_collections:2::el7 |
before 0:3.6-4.el7 | 0:3.6-4.el7 |
python27-python-debugRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-debuginfoRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-develRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-libsRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-pipRed Hat:rhel_software_collections:2::el7 |
before 0:8.1.2-2.el7 | 0:8.1.2-2.el7 |
python27-python-setuptoolsRed Hat:rhel_software_collections:2::el7 |
before 0:0.9.8-6.el7 | 0:0.9.8-6.el7 |
python27-python-testRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-toolsRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python27-python-virtualenvRed Hat:rhel_software_collections:2::el7 |
before 0:13.1.0-2.el7 | 0:13.1.0-2.el7 |
python27-tkinterRed Hat:rhel_software_collections:2::el7 |
before 0:2.7.13-3.el7 | 0:2.7.13-3.el7 |
python-debugRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debuginfoRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-develRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-testRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-toolsRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
tkinterRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
pythonRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-libsRed Hat:enterprise_linux:7::client |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debugRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-testRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-toolsRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
tkinterRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
pythonRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-develRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-libsRed Hat:enterprise_linux:7::computenode |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debugRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debuginfoRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-testRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-toolsRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
tkinterRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
pythonRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-develRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-libsRed Hat:enterprise_linux:7::server |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debugRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-testRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-toolsRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
tkinterRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
pythonRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-develRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python-libsRed Hat:enterprise_linux:7::workstation |
before 0:2.7.5-58.el7 | 0:2.7.5-58.el7 |
python2.7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 35 moreShow less2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.42.7.6-8ubuntu0.52.7.6-8ubuntu0.6+esm22.7.6-8ubuntu0.6+esm32.7.6-8ubuntu0.6+esm52.7.6-8ubuntu0.6+esm62.7.6-8ubuntu0.6+esm72.7.6-8ubuntu0.6+esm82.7.6-8ubuntu0.6+esm92.7.6-8ubuntu0.6+esm102.7.6-8ubuntu0.6+esm112.7.6-8ubuntu0.6+esm122.7.6-8ubuntu0.6+esm132.7.6-8ubuntu0.6+esm142.7.6-8ubuntu0.6+esm152.7.6-8ubuntu0.6+esm162.7.6-8ubuntu0.6+esm172.7.6-8ubuntu0.6+esm182.7.6-8ubuntu0.6+esm202.7.6-8ubuntu0.6+esm212.7.6-8ubuntu0.6+esm222.7.6-8ubuntu0.6+esm242.7.6-8ubuntu0.6+esm252.7.6-8ubuntu0.6+esm262.7.6-8ubuntu0.6+esm282.7.6-8ubuntu0.6+esm292.7.6-8ubuntu0.6+esm30 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9365 is a medium vulnerability (CVSS 5.8) in Python, published December 12, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.01%, the 87th percentile. Fixed in python2.7 2.7.9-1.
References
access.redhat.com/errata/RHSA-2017:1162
python.org/dev/peps/pep-0476
securityfocus.com/bid/71639
bugs.python.org/issue22417
Show 40 moreShow less
security.gentoo.org/glsa/201503-10
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
openwall.com/lists/oss-security/2014/12/11/1
support.apple.com/kb/HT205031
nvd.nist.gov/vuln/detail/CVE-2014-9365
github.com/advisories/GHSA-fj2p-9cqv-m944
security-tracker.debian.org/tracker/CVE-2014-9365
advisories.mageia.org/MGASA-2015-0091.html
bugs.mageia.org/show_bug.cgi?id=14780
bugzilla.redhat.com/show_bug.cgi?id=1173041
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1162.json
cve.org/CVERecord?id=CVE-2014-9365
ubuntu.com/security/CVE-2014-9365
seclists.org/oss-sec/2014/q4/1022