p PatchFirst

CVE-2013-2037

CVE-2013-2037

This page contains facts from public vulnerability sources. Check the original advisory before updating.

httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 8.7 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-httplib2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.8-2

    Update to 0.8-2

  • python-httplib2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.8-2

    Update to 0.8-2

  • python-httplib2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.8-2

    Update to 0.8-2

  • httplib2 PyPI

    Versions
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.8
    • 0.9
    • 0.9.1
    • 0.9.2
    Affected ranges
    • ECOSYSTEM: < 0.10.1

    Update to 0.10.1

  • httplib2 PyPI

    Versions
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.8
    Affected ranges
    • ECOSYSTEM: < 0.9

    Update to 0.9

Original sources

Check your server →