ALT-PU-2014-3195-1

Package update python-module-httplib2 in branch sisyphus

Version0.9-alt1

Published2014-08-21

Max severityMEDIUM

Severity:

Closed issues (2)

LOW2.6

httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Published: 2014-01-18Modified: 2026-04-29

CVSS 2.0LOW 2.6

CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:P/A:N

References

GHSA-q48q-77qv-cf9p

MEDIUM6.6

httplib2 incorrectly checks SSL certificate

Published: 2022-05-14Modified: 2024-09-23

CVSS 3.xMEDIUM 6.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS 4.0MEDIUM 6.6

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References