Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-DEBIAN9-PYTHON27-306606
- published 12 Dec 2014
- disclosed 12 Dec 2014
Introduced: 12 Dec 2014CVE-2014-9365 Open this link in a new tab
How to fix?
python2.7 to version 2.7.9-1 or higher.
Note: Versions mentioned in the description apply to the upstream
How to fix? for
Debian:9 relevant versions.
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.