CVE-2013-2037

httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References
Link Resource
http://www.ubuntu.com/usn/USN-1948-1 Third Party Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602 Mailing List Issue Tracking Third Party Advisory
http://seclists.org/oss-sec/2013/q2/257 Mailing List Third Party Advisory
http://code.google.com/p/httplib2/issues/detail?id=282 Exploit Third Party Advisory
https://bugs.launchpad.net/httplib2/+bug/1175272 Exploit Patch
http://www.securityfocus.com/bid/52179 Third Party Advisory VDB Entry
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:*:*:*
cpe:2.3:a:httplib2_project:httplib2:0.8:*:*:*:*:*:*:*

Information

Published : 2014-01-18 13:55

Updated : 2018-12-06 12:53


NVD link : CVE-2013-2037

Mitre link : CVE-2013-2037


JSON object : View

CWE
CWE-20

Improper Input Validation

Advertisement

dedicated server usa

Products Affected

httplib2_project

  • httplib2

canonical

  • ubuntu_linux