CVE-2014-9365

Name	CVE-2014-9365
Description	The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python2.7 (PTS)	jessie, jessie (lts)	2.7.9-2-ds1-1+deb8u12	fixed
	stretch (security)	2.7.13-2+deb9u6	fixed
	stretch (lts), stretch	2.7.13-2+deb9u9	fixed
	buster	2.7.16-2+deb10u1	fixed
	buster (security)	2.7.16-2+deb10u4	fixed
	bullseye	2.7.18-8+deb11u1	fixed
python3.4 (PTS)	jessie, jessie (lts)	3.4.2-1+deb8u17	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
python2.5	source	(unstable)	(unfixed)
python2.6	source	(unstable)	(unfixed)
python2.7	source	(unstable)	2.7.9-1
python3.1	source	(unstable)	(unfixed)
python3.2	source	(unstable)	(unfixed)
python3.3	source	(unstable)	(unfixed)
python3.4	source	(unstable)	3.4.2-2

Notes

[squeeze] - python2.5 <no-dsa> (Too intrusive to backport)
[wheezy] - python2.6 <no-dsa> (Too intrusive to backport)
[squeeze] - python2.6 <no-dsa> (Too intrusive to backport)
[wheezy] - python2.7 <no-dsa> (Too intrusive to backport)
[squeeze] - python3.1 <no-dsa> (Too intrusive to backport)
[wheezy] - python3.2 <no-dsa> (Too intrusive to backport)
[jessie] - python3.4 <ignored> (Backporting to stable would break existing applications)
http://bugs.python.org/issue22417