CVE catalog

CVE-2014-9365

DEBIAN-CVE-2014-9365

[CVE catalog]

Severity
Medium · CVSS 4.7CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
3.01% · Oct 25, 2026

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntupython2.7pro2.7.5-8ubuntu3vulnerable
Ubuntupython2.7pro2.7.5-8ubuntu4vulnerable
Ubuntupython2.7pro2.7.6-2vulnerable
Ubuntupython2.7pro2.7.6-2ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-3vulnerable
Ubuntupython2.7pro2.7.6-3ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-4vulnerable
Ubuntupython2.7pro2.7.6-4ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-5vulnerable
Ubuntupython2.7pro2.7.6-7vulnerable
Ubuntupython2.7pro2.7.6-8vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.3vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.4vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.5vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm3vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm5vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm6vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm7vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm8vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm9vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm10vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm11vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm12vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm13vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm14vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm15vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm16vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm17vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm18vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm20vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm21vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm22vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm24vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm25vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm26vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm28vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm29vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm30vulnerable
Debianpython2.7112.7.9-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython2.7deb112.7.9-1Not reportedDEBIAN-CVE-2014-9365Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]