Date: Thu, 11 Dec 2014 11:39:31 -0500 (EST) From: cve-assign@...re.org To: Alex Gaynor <alex.gaynor@...il.com> cc: cve-assign@...re.org, "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: CVE request: Python, standard library HTTP clients -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > When Python's standard library HTTP clients (httplib, urllib, urllib2, > xmlrpclib) are used to access resources with HTTPS, by default the > certificate > is not checked against any trust store, nor is the hostname in the > certificate > checked against the requested host. It was possible to configure a trust > root > to be checked against, however there were no faculties for hostname > checking. > > This made MITM attacks against the HTTP clients trivial, and violated RFC > 2818 > (http://tools.ietf.org/html/rfc2818#section-3). > > Python 2.7.9 has been issued to resolve this issue. It is also resolved in > 3.4.3, which has not yet been released. Use CVE-2014-9365. - --- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEVAwUBVInIiKllVAevmvmsAQKUEAf9FEfp7oNywlU7NaOfSjaMVJi5B3wApMO4 STpRGPKPa7NjJOF1FapTBMhODnRcViP7yvrVvBgapAQosnsE4nZq9Q5ccZQNvx3n IUAJm61K1CqPAW/YuzrCRQzrZZpDxrNTnSGV4y2ml2zCOUtTcVBqnYUAW2DjgOEs qs0kH8PlDfN7qhpUWVbD3Ix65WTyJKd5kwzp23SO50p/ZqlbAGSN2BJ5d2rRP7wE o5N06E/7ALziQg+4lTPtdBC380BaU/RS5tBjvw1XpKiqDKGQFTZvqxdC9maxR3dD vnOM/YrCW6GQKwWv5KE8zEHsRsu4NKCns6c/B3mM8+eEIZqbDleA1w== =GCa6 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.