CVE-2013-2037: PYSEC-2014-81 - httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the

CVE-2013-2037 · Severity: low · CVSS 3.1 · Published 2014-01-18

Technologies: httplib2 (PyPI). Vendors: PyPI.

Executive brief

httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected products

PyPI httplib2

Related threats

httplib2 unbounded decompression denial of service
PYSEC-2021-16 - httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long s
PYSEC-2020-46 - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers