ID

VAR-201412-0061

CVE

CVE-2014-9365

TITLE

CPython of httplib Library etc. HTTP At the client SSL Vulnerability impersonating a server

DESCRIPTION

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Supplementary information : CWE Vulnerability type by CWE-295: Improper Certificate Validation ( Incorrect certificate validation ) Has been identified. http://cwe.mitre.org/data/definitions/295.htmlMan-in-the-middle attacks (man-in-the-middle attack) Through any valid certificate SSL There is a possibility of impersonating a server. Python is prone to a security-bypass vulnerability. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. The language is scalable, supports modules and packages, and supports multiple platforms. CPython (aka Python) is a Python interpreter implemented in C language. There are security vulnerabilities in the HTTP clients of httplib, urllib, urllib2 and xmlrpclib libraries in 2.x versions before 2.7.9 and 3.x versions before 3.4.3. The vulnerability stems from the fact that the certificate is not properly verified when the program accesses the HTTPS URL . 7) - noarch, x86_64 3. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL. The python27 Software Collection has been upgraded to version 2.7.13, which provides a number of bug fixes and enhancements over the previous version. (BZ#1417838) 4. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/python < 3.3.5-r1 *>= 2.7.9-r1 >= 3.3.5-r1 Description =========== Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Python 3.3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-3.3.5-r1" All Python 2.7 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.9-r1" References ========== [ 1 ] CVE-2013-1752 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1752 [ 2 ] CVE-2013-7338 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7338 [ 3 ] CVE-2014-1912 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1912 [ 4 ] CVE-2014-2667 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2667 [ 5 ] CVE-2014-4616 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4616 [ 6 ] CVE-2014-7185 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7185 [ 7 ] CVE-2014-9365 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9365 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201503-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code (CVE-2014-1912). This updates the python package to version 2.7.6, which fixes several other bugs, including denial of service flaws due to unbound readline() calls in the ftplib and nntplib modules (CVE-2013-1752). Denial of service flaws due to unbound readline() calls in the imaplib, poplib, and smtplib modules (CVE-2013-1752). A gzip bomb and unbound read denial of service flaw in python XMLRPC library (CVE-2013-1753). Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616). The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script&#039;s source code or execute arbitrary scripts in the server&#039;s document root (CVE-2014-4650). Python before 2.7.8 is vulnerable to an integer overflow in the buffer type (CVE-2014-7185). It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking (CVE-2014-9365). The python-pip and tix packages was added due to missing build dependencies. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1753 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1912 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4616 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9365 http://advisories.mageia.org/MGASA-2014-0085.html http://advisories.mageia.org/MGASA-2014-0139.html http://advisories.mageia.org/MGASA-2014-0285.html http://advisories.mageia.org/MGASA-2014-0399.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 2/X86_64: d58b1b80b3dc737786ed59c11716efd7 mbs2/x86_64/lib64python2.7-2.7.9-1.mbs2.x86_64.rpm 094be70fc92a99ec299026414043a5ed mbs2/x86_64/lib64python-devel-2.7.9-1.mbs2.x86_64.rpm daaaff2334797306a8be9d6a8f4fa69a mbs2/x86_64/python-2.7.9-1.mbs2.x86_64.rpm 3418e101353fde429817cfea0298193b mbs2/x86_64/python3-pip-1.4.1-4.2.mbs2.noarch.rpm e0e7d10ce59e9eccd69d760fb377c5b2 mbs2/x86_64/python-docs-2.7.9-1.mbs2.noarch.rpm eaf8978737e06d46ddd2ee6d78658ae4 mbs2/x86_64/python-pip-1.4.1-4.2.mbs2.noarch.rpm ea585f2ec67cb5a4838c1fc08e615fa5 mbs2/x86_64/tix-8.4.3-9.mbs2.x86_64.rpm 5f83e970c318d9dad119943e986f8182 mbs2/x86_64/tix-devel-8.4.3-9.mbs2.x86_64.rpm a6b1667ad8ab5000b1eef329713aa5c3 mbs2/x86_64/tkinter-2.7.9-1.mbs2.x86_64.rpm 7ce085d9fb460e1093513d5579174697 mbs2/x86_64/tkinter-apps-2.7.9-1.mbs2.x86_64.rpm 85e67e3e2373ea06f2b2eb0e69682937 mbs2/SRPMS/python-2.7.9-1.mbs2.src.rpm 407d147f773bbc3fc3c5430619ee0f65 mbs2/SRPMS/python-pip-1.4.1-4.2.mbs2.src.rpm b561abc0b4fec04f0c398068faa5952f mbs2/SRPMS/tix-8.4.3-9.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVFY0qmqjQ0CJFipgRAnTSAKDqsSqyFLO4F/4mq6ZmL7fZ+yYhjgCeNkAn fc0CS3IgYNQdHz4EMRvQ9Tg= =giLB -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: python security and bug fix update Advisory ID: RHSA-2017:1868-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:1868 Issue date: 2017-08-01 CVE Names: CVE-2014-9365 ===================================================================== 1. Summary: An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365) Note: The Python standard library was updated to enable certificate verification by default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219110) Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1173041 - CVE-2014-9365 python: failure to validate certificates in the HTTP client with TLS (PEP 476) 1272562 - Memory leaks found by unit tests 1297522 - Undefined python_provide causes silently missing provides 1333064 - /CoreOS/python/Sanity/gdb test is failing on s390x 1364444 - Python fails to decode X.509 cert with GEN_RID subject alt name 1368076 - threading wait(timeout) doesn't return after timeout if system clock is set backward 1373363 - Incorrect parsing of regular expressions 1432003 - After logrotate , dynamic looping call gets 'ValueError: I/O operation on closed file' on self.stream.flush() in /usr/lib64/python2.7/logging/handlers.py 1439734 - Backport fix for shutil.make_archive doesn't archive empty directories 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: python-2.7.5-58.el7.src.rpm x86_64: python-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.i686.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-libs-2.7.5-58.el7.i686.rpm python-libs-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: python-debug-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-devel-2.7.5-58.el7.x86_64.rpm python-test-2.7.5-58.el7.x86_64.rpm python-tools-2.7.5-58.el7.x86_64.rpm tkinter-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: python-2.7.5-58.el7.src.rpm x86_64: python-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.i686.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-devel-2.7.5-58.el7.x86_64.rpm python-libs-2.7.5-58.el7.i686.rpm python-libs-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: python-debug-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-test-2.7.5-58.el7.x86_64.rpm python-tools-2.7.5-58.el7.x86_64.rpm tkinter-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: python-2.7.5-58.el7.src.rpm aarch64: python-2.7.5-58.el7.aarch64.rpm python-debuginfo-2.7.5-58.el7.aarch64.rpm python-devel-2.7.5-58.el7.aarch64.rpm python-libs-2.7.5-58.el7.aarch64.rpm ppc64: python-2.7.5-58.el7.ppc64.rpm python-debuginfo-2.7.5-58.el7.ppc.rpm python-debuginfo-2.7.5-58.el7.ppc64.rpm python-devel-2.7.5-58.el7.ppc64.rpm python-libs-2.7.5-58.el7.ppc.rpm python-libs-2.7.5-58.el7.ppc64.rpm ppc64le: python-2.7.5-58.el7.ppc64le.rpm python-debuginfo-2.7.5-58.el7.ppc64le.rpm python-devel-2.7.5-58.el7.ppc64le.rpm python-libs-2.7.5-58.el7.ppc64le.rpm s390x: python-2.7.5-58.el7.s390x.rpm python-debuginfo-2.7.5-58.el7.s390.rpm python-debuginfo-2.7.5-58.el7.s390x.rpm python-devel-2.7.5-58.el7.s390x.rpm python-libs-2.7.5-58.el7.s390.rpm python-libs-2.7.5-58.el7.s390x.rpm x86_64: python-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.i686.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-devel-2.7.5-58.el7.x86_64.rpm python-libs-2.7.5-58.el7.i686.rpm python-libs-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): aarch64: python-debug-2.7.5-58.el7.aarch64.rpm python-debuginfo-2.7.5-58.el7.aarch64.rpm python-test-2.7.5-58.el7.aarch64.rpm python-tools-2.7.5-58.el7.aarch64.rpm tkinter-2.7.5-58.el7.aarch64.rpm ppc64: python-debug-2.7.5-58.el7.ppc64.rpm python-debuginfo-2.7.5-58.el7.ppc64.rpm python-test-2.7.5-58.el7.ppc64.rpm python-tools-2.7.5-58.el7.ppc64.rpm tkinter-2.7.5-58.el7.ppc64.rpm ppc64le: python-debug-2.7.5-58.el7.ppc64le.rpm python-debuginfo-2.7.5-58.el7.ppc64le.rpm python-test-2.7.5-58.el7.ppc64le.rpm python-tools-2.7.5-58.el7.ppc64le.rpm tkinter-2.7.5-58.el7.ppc64le.rpm s390x: python-debug-2.7.5-58.el7.s390x.rpm python-debuginfo-2.7.5-58.el7.s390x.rpm python-test-2.7.5-58.el7.s390x.rpm python-tools-2.7.5-58.el7.s390x.rpm tkinter-2.7.5-58.el7.s390x.rpm x86_64: python-debug-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-test-2.7.5-58.el7.x86_64.rpm python-tools-2.7.5-58.el7.x86_64.rpm tkinter-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: python-2.7.5-58.el7.src.rpm x86_64: python-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.i686.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-devel-2.7.5-58.el7.x86_64.rpm python-libs-2.7.5-58.el7.i686.rpm python-libs-2.7.5-58.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: python-debug-2.7.5-58.el7.x86_64.rpm python-debuginfo-2.7.5-58.el7.x86_64.rpm python-test-2.7.5-58.el7.x86_64.rpm python-tools-2.7.5-58.el7.x86_64.rpm tkinter-2.7.5-58.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-9365 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html https://access.redhat.com/articles/2039753 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZgOR/XlSAg2UNWIIRAtf8AJ43qpkGM8a2Q4bgios7Yh3TrUS+fgCfdA2W rxrzegAW6UdQbKGtPSHGsBo= =BV91 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Alex Gaynor

SOURCES

LAST UPDATE DATE

2024-11-23T20:12:36.977000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE