UpHeron
All vulnerabilities

Servers and applications

CVE-2014-9365

The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows…

Severity
Medium 5.8
Published
12 Dec 2014
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.4.2
  • Version 3.4.1
  • Version 3.4.0
  • Version 3.4-alpha1
All 84 release lines
  • Version 2.0
  • Version 2.0.1
  • Version 2.1
  • Version 2.1.1
  • Version 2.1.2
  • Version 2.1.3
  • Version 2.2
  • Version 2.2.1
  • Version 2.2.2
  • Version 2.2.3
  • Version 2.3.1
  • Version 2.3.2
  • Version 2.3.3
  • Version 2.3.4
  • Version 2.3.5
  • Version 2.3.7
  • Version 2.4.1
  • Version 2.4.2
  • Version 2.4.3
  • Version 2.4.4
  • Version 2.4.6
  • Version 2.5.1
  • Version 2.5.2
  • Version 2.5.3
  • Version 2.5.4
  • Version 2.5.6
  • Version 2.5.150
  • Version 2.6.1
  • Version 2.6.2
  • Version 2.6.3
  • Version 2.6.4
  • Version 2.6.5
  • Version 2.6.6
  • Version 2.6.7
  • Version 2.6.8
  • Version 2.6.2150
  • Version 2.6.6150
  • Version 2.7.1-rc1
  • Version 2.7.1
  • Version 2.7.2-rc1
  • Version 2.7.3
  • Version 2.7.4
  • Version 2.7.5
  • Version 2.7.6
  • Version 2.7.7
  • Version 2.7.8
  • Version 2.7.1150
  • Version 2.7.2150
  • Version 3.0
  • Version 3.0.1
  • Version 3.1
  • Version 3.1.1
  • Version 3.1.2
  • Version 3.1.3
  • Version 3.1.4
  • Version 3.1.5
  • Version 3.1.2150
  • Version 3.2-alpha
  • Version 3.2
  • Version 3.2.1
  • Version 3.2.2
  • Version 3.2.3
  • Version 3.2.4
  • Version 3.2.5
  • Version 3.2.6
  • Version 3.2.2150
  • Version 3.3-beta2
  • Version 3.3
  • Version 3.3.1-rc1
  • Version 3.3.1
  • Version 3.3.2
  • Version 3.3.3-rc1
  • Version 3.3.3-rc2
  • Version 3.3.3
  • Version 3.3.4-rc1
  • Version 3.3.4
  • Version 3.3.5-rc1
  • Version 3.3.5-rc2
  • Version 3.3.5
  • Version 3.3.6-rc1
  • Version 3.4-alpha1
  • Version 3.4.0
  • Version 3.4.1
  • Version 3.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-9365
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-9365