CVE-2014-9365

SSL Certificate Validation Vulnerability

• CVSS 5.8
• CWE-295: Improper Certificate Validation
• Cryptographic
• Remote

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE

CVE-2014-9365

CWE

CWE-295: Improper Certificate Validation

CVSS base score

5.8

Published

2014-12-12

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade to a version of Python that is 2.7.9+ or 3.4.3+.

import urllib.request

def https_request(url):
    response = urllib.request.urlopen(url)
    return response.read()

if __name__ == "__main__":
    url = "https://example.com"
    response = https_request(url)
    print("Response:", response)

import ssl
import urllib.request

def https_request(url):
    # Create an SSL context that verifies certificates
    context = ssl.create_default_context()
    
    # Make an HTTPS request with certificate validation
    with urllib.request.urlopen(url, context=context) as response:
        return response.read()

if __name__ == "__main__":
    url = "https://example.com"
    response = https_request(url)
    print("Response:", response)

@misc{vaitp:cve20149365,
  title        = {{SSL Certificate Validation Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-9365},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-9365/}}
}