{"id":"CVE-2014-9365","aliases":["AZL-84278","DEBIAN-CVE-2014-9365","EUVD-2014-9187","GHSA-fj2p-9cqv-m944","MGASA-2015-0091","PSF-2014-7","RHSA-2017:1162","RHSA-2017:1868","UBUNTU-CVE-2014-9365"],"status":"published","title":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in...","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03012,"percentile":0.87494,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-12-12T11:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:11","package":"python2.7","fixed_in":["2.7.9-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"python","fixed_in":["2.7.9-1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-mod_wsgi","fixed_in":["0:4.5.13-1.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-mod_wsgi-debuginfo","fixed_in":["0:4.5.13-1.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-coverage","fixed_in":["0:3.6-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-coverage-debuginfo","fixed_in":["0:3.6-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-debug","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-debuginfo","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-devel","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-libs","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-pip","fixed_in":["0:8.1.2-2.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-setuptools","fixed_in":["0:0.9.8-4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-test","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-tools","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-virtualenv","fixed_in":["0:13.1.0-2.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-tkinter","fixed_in":["0:2.7.13-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-mod_wsgi","fixed_in":["0:4.5.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-mod_wsgi-debuginfo","fixed_in":["0:4.5.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-coverage","fixed_in":["0:3.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-coverage-debuginfo","fixed_in":["0:3.6-4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-debug","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-debuginfo","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-devel","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-libs","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-pip","fixed_in":["0:8.1.2-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-setuptools","fixed_in":["0:0.9.8-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-test","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-tools","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-virtualenv","fixed_in":["0:13.1.0-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-tkinter","fixed_in":["0:2.7.13-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-debug","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-debuginfo","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-devel","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-test","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-tools","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tkinter","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-libs","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-debug","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-debuginfo","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-test","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-tools","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tkinter","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-devel","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-libs","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-debug","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-debuginfo","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-test","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-tools","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tkinter","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-devel","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-libs","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-debug","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-debuginfo","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-test","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-tools","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tkinter","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-devel","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-libs","fixed_in":["0:2.7.5-58.el7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"docbook5-style-xsl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.79.2-11"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.9-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.9-1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-mod_wsgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.13-1.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-mod_wsgi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.13-1.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-coverage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-coverage-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.2-2.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8-4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-2.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"python27-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-mod_wsgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-mod_wsgi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-coverage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-coverage-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.2-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-setuptools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"python27-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.13-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.5-58.el7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4","2.7.6-8ubuntu0.5","2.7.6-8ubuntu0.6+esm2","2.7.6-8ubuntu0.6+esm3","2.7.6-8ubuntu0.6+esm5","2.7.6-8ubuntu0.6+esm6","2.7.6-8ubuntu0.6+esm7","2.7.6-8ubuntu0.6+esm8","2.7.6-8ubuntu0.6+esm9","2.7.6-8ubuntu0.6+esm10","2.7.6-8ubuntu0.6+esm11","2.7.6-8ubuntu0.6+esm12","2.7.6-8ubuntu0.6+esm13","2.7.6-8ubuntu0.6+esm14","2.7.6-8ubuntu0.6+esm15","2.7.6-8ubuntu0.6+esm16","2.7.6-8ubuntu0.6+esm17","2.7.6-8ubuntu0.6+esm18","2.7.6-8ubuntu0.6+esm20","2.7.6-8ubuntu0.6+esm21","2.7.6-8ubuntu0.6+esm22","2.7.6-8ubuntu0.6+esm24","2.7.6-8ubuntu0.6+esm25","2.7.6-8ubuntu0.6+esm26","2.7.6-8ubuntu0.6+esm28","2.7.6-8ubuntu0.6+esm29","2.7.6-8ubuntu0.6+esm30"]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"python","product":"python"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:1162","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://www.python.org/dev/peps/pep-0476/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","evidence","web"]},{"url":"http://www.securityfocus.com/bid/71639","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1166","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1868","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://bugs.python.org/issue22417","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"https://security.gentoo.org/glsa/201503-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"https://www.python.org/downloads/release/python-279/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/12/11/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9365","tags":["web","advisory"]},{"url":"https://www.python.org/dev/peps/pep-0476"},{"url":"https://www.python.org/downloads/release/python-279"},{"url":"https://github.com/advisories/GHSA-fj2p-9cqv-m944"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9365","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0091.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173041","tags":["report"]},{"url":"https://bugs.python.org/issue22417","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/articles/2039753","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-python","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1336776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1344674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1355805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1417108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1417139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1417838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1430763","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1162.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9365","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9365","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1272562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1364444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1368076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1373363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439734","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1868.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9365","tags":["report"]},{"url":"http://seclists.org/oss-sec/2014/q4/1022","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9365","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:00:00Z","modified":"2024-08-06T13:40:25.293Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9187","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:00:00Z","modified":"2024-08-06T13:40:25Z","updated_at":"2026-11-03T01:56:49.310799Z"}],"ghsa":[{"id":"GHSA-fj2p-9cqv-m944","title":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in...","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2022-05-13T01:31:01Z","modified":"2025-04-12T12:44:09Z","updated_at":"2026-11-02T15:01:20.346559Z"}],"nvd":[{"id":"CVE-2014-9365","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:59:07.063Z","modified":"2026-06-17T00:18:10.5Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"RHSA-2017:1162","title":"Red Hat Security Advisory: python27 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T09:23:34Z","modified":"2026-08-05T10:04:23Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:1868","title":"Red Hat Security Advisory: python security and bug fix update","status":"published","published":"2024-09-13T09:24:02Z","modified":"2026-08-05T10:04:35Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"AZL-84278","title":"CVE-2014-9365 affecting package docbook5-style-xsl 1.79.2-11","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:59:07Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CVE-2014-9365","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:59:07Z","modified":"2026-04-16T06:24:36.116716305Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9365","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:59:07.063Z","modified":"2026-08-27T12:47:31.114059844Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0091","title":"Updated python packages fix CVE-2014-9365","description":"Updated python packages fix security vulnerability:\n\nWhen Python's standard library HTTP clients (httplib, urllib, urllib2,\nxmlrpclib) are used to access resources with HTTPS, by default the certificate\nis not checked against any trust store, nor is the hostname in the certificate\nchecked against the requested host. It was possible to configure a trust root\nto be checked against, however there were no faculties for hostname checking\n(CVE-2014-9365).\n\nNote that this issue also affects python3, and is fixed upstream in version\n3.4.3, but the fix was considered too intrusive to backport to Python3 3.3.x.\nNo update for the python3 package for this issue is planned at this time.\n","status":"published","published":"2015-03-05T19:34:09Z","modified":"2026-04-16T06:24:00.152472889Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"PSF-2014-7","title":"Validate TLS certificate","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:00:00Z","modified":"2025-10-09T00:57:57.036085Z","updated_at":"2026-11-02T15:52:50.263679Z"},{"id":"UBUNTU-CVE-2014-9365","description":"The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-12-12T11:59:00Z","modified":"2026-09-08T19:45:05.896318504Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}