ALT Linux Team

Package python-module-httplib2 update in sisyphus on 2014-08-21

ALT-PU-2014-3195-1

Package python-module-httplib2 updated to version 0.9-alt1 for branch sisyphus in task 127540.

Closed vulnerabilities

Published: 2014-01-18
Modified: 2026-04-29

CVE-2013-2037

httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Severity: LOW (2.6)Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
References:
Published: 2022-05-14
Modified: 2024-09-23

GHSA-q48q-77qv-cf9p

httplib2 incorrectly checks SSL certificate

Severity: MEDIUM (6.6)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM (6.6)Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
References:
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: 2.1.2
Back to top