CVE-2013-2037
published 2014-01-18CVE-2013-2037: httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common…
PriorityP414low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
1.32%
67.8th percentile
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | python-httplib2 | < python-httplib2 0.8-2 (bookworm) | python-httplib2 0.8-2 (bookworm) |
| httplib2_project | httplib2 | <= 0.7.2 | — |
| httplib2_project | httplib2 | — | — |
| httplib2_project | httplib2 | >= 0 < 0.10.1 | 0.10.1 |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
osv2.6LOW
vendor_debian2.6LOW
vendor_redhat2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
httplib2 vulnerability
vendor_ubuntu·2013-09-09
CVE-2013-2037 httplib2 vulnerability
Title: httplib2 vulnerability
Summary: Fraudulent security certificates could allow sensitive information to
be exposed when accessing the Internet.
It was discovered that httplib2 only validated SSL certificates on the
first request to a connection, and didn't report validation failures on
subsequent requests. If a remote attacker were able to perform a
machine-in-the-middle attack, this flaw could possibly be exploited in certain
scenarios to alter or compromise confidential information in applications
that used the httplib2 library.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-httplib2: ssl cert incorrect error handling
vendor_redhat·2013-05-01·CVSS 2.6
CVE-2013-2037 [LOW] python-httplib2: ssl cert incorrect error handling
python-httplib2: ssl cert incorrect error handling
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Statement: This issue affects the versions of python-httplib2 as shipped with Red Hat Update Infrastructure 2.1. Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Debian
CVE-2013-2037: python-httplib2 - httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not ...
vendor_debian·2013·CVSS 2.6
CVE-2013-2037 [LOW] CVE-2013-2037: python-httplib2 - httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not ...
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Scope: local
bookworm: resolved (fixed in 0.8-2)
bullseye: resolved (fixed in 0.8-2)
forky: resolved (fixed in 0.8-2)
sid: resolved (fixed in 0.8-2)
trixie: resolved (fixed in 0.8-2)
OSV
httplib2 incorrectly checks SSL certificate
osv·2022-05-14
CVE-2013-2037 [MEDIUM] httplib2 incorrectly checks SSL certificate
httplib2 incorrectly checks SSL certificate
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
GHSA
httplib2 incorrectly checks SSL certificate
ghsa·2022-05-14
CVE-2013-2037 [MEDIUM] CWE-20 httplib2 incorrectly checks SSL certificate
httplib2 incorrectly checks SSL certificate
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
OSV
CVE-2013-2037: httplib2 0
osv·2014-01-18·CVSS 2.6
CVE-2013-2037 [LOW] CVE-2013-2037: httplib2 0
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-2037 python-httplib2: ssl cert incorrect error handling
bugzilla·2013-05-02·CVSS 2.6
CVE-2013-2037 [LOW] CVE-2013-2037 python-httplib2: ssl cert incorrect error handling
CVE-2013-2037 python-httplib2: ssl cert incorrect error handling
Reported by [email protected], Apr 23, 2013
What steps will reproduce the problem?
1. Make a request to an HTTPS server with a domain name not matching one that is specified in the corresponding SSL certificate.
2. Repeat the request once again.
Expected behavior: both requests fail with CertificateHostnameMismatch error.
Actual behavior: the first request fails with CertificateHostnameMismatch, but the second one succeeds.
The problem is caused by incorrect error handling in connect() method of HTTPSConnectionWithTimeout class. The created socket is closed in case of a general SSL error, but it's not closed in case of CertificateHostnameMismatchError (as ssl module doesn't provide hostname checking and it's done b
Bugzilla
CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [epel-5]
bugzilla·2013-05-02·CVSS 2.6
CVE-2013-2037 [LOW] CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [epel-5]
CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
epel-5 tracking bug for py
Bugzilla
CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [fedora-all]
bugzilla·2013-05-02·CVSS 2.6
CVE-2013-2037 [LOW] CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [fedora-all]
CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue aff
Bugzilla
CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [epel-all]
bugzilla·2013-05-02·CVSS 2.6
CVE-2013-2037 [LOW] CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [epel-all]
CVE-2013-2037 Python httplib2: ssl cert incorrect error handling [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602http://code.google.com/p/httplib2/issues/detail?id=282http://seclists.org/oss-sec/2013/q2/257http://www.securityfocus.com/bid/52179http://www.ubuntu.com/usn/USN-1948-1https://bugs.launchpad.net/httplib2/+bug/1175272http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602http://code.google.com/p/httplib2/issues/detail?id=282http://seclists.org/oss-sec/2013/q2/257http://www.securityfocus.com/bid/52179http://www.ubuntu.com/usn/USN-1948-1https://bugs.launchpad.net/httplib2/+bug/1175272
2014-01-18
Published