GHSA-q48q-77qv-cf9p

httplib2 incorrectly checks SSL certificate

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-2037

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	httplib2	< 0.10.1	0.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-2037 advisory
https://github.com/httplib2/httplib2/issues/5 web
https://github.com/httplib2/httplib2/commit/40cbdcc8586f2292fa0e76a3e8c012f0cc9ed919 web
https://bugs.launchpad.net/httplib2/+bug/1175272 web
https://github.com/httplib2/httplib2 package
https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2014-81.yaml web
https://web.archive.org/web/20200228052625/http://www.securityfocus.com/bid/52179 web
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602 web
http://code.google.com/p/httplib2/issues/detail?id=282 web
http://seclists.org/oss-sec/2013/q2/257 web
http://www.ubuntu.com/usn/USN-1948-1 web