[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.1412111137240.4468@beijing.mitre.org>
Date: Thu, 11 Dec 2014 11:39:31 -0500 (EST)
From: cve-assign@...re.org
To: Alex Gaynor <alex.gaynor@...il.com>
cc: cve-assign@...re.org,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE request: Python, standard library HTTP clients
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> When Python's standard library HTTP clients (httplib, urllib, urllib2,
> xmlrpclib) are used to access resources with HTTPS, by default the
> certificate
> is not checked against any trust store, nor is the hostname in the
> certificate
> checked against the requested host. It was possible to configure a trust
> root
> to be checked against, however there were no faculties for hostname
> checking.
>
> This made MITM attacks against the HTTP clients trivial, and violated RFC
> 2818
> (http://tools.ietf.org/html/rfc2818#section-3).
>
> Python 2.7.9 has been issued to resolve this issue. It is also resolved in
> 3.4.3, which has not yet been released.
Use CVE-2014-9365.
- ---
CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEVAwUBVInIiKllVAevmvmsAQKUEAf9FEfp7oNywlU7NaOfSjaMVJi5B3wApMO4
STpRGPKPa7NjJOF1FapTBMhODnRcViP7yvrVvBgapAQosnsE4nZq9Q5ccZQNvx3n
IUAJm61K1CqPAW/YuzrCRQzrZZpDxrNTnSGV4y2ml2zCOUtTcVBqnYUAW2DjgOEs
qs0kH8PlDfN7qhpUWVbD3Ix65WTyJKd5kwzp23SO50p/ZqlbAGSN2BJ5d2rRP7wE
o5N06E/7ALziQg+4lTPtdBC380BaU/RS5tBjvw1XpKiqDKGQFTZvqxdC9maxR3dD
vnOM/YrCW6GQKwWv5KE8zEHsRsu4NKCns6c/B3mM8+eEIZqbDleA1w==
=GCa6
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
