Man-in-the-Middle (MitM)

2019-01-1509:17:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

JSON

python27-python is vulnerable to man-in-the-middle (MitM) attacks. The vulnerability exists as the HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject’s (b) Common Name or © subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CPENameOperatorVersion
python27-python-virtualenveq1.10.1__2.el6
python27-python-virtualenveq13.1.0__1.el6
python27-mod_wsgieq3.4__5.el6op
python27-mod_wsgieq3.4__26.el6op
python27-mod_wsgieq3.4__12.el6
python27-mod_wsgieq3.4__11.el6
python27-python-pipeq1.4__7.el6op
python27-python-pipeq1.5.6__5.el6
python27-python-pipeq7.1.0__2.el6
python27-python-setuptoolseq0.9.8__2.el6

Name	Operator	Version
python27-python-virtualenv	eq	1.10.1__2.el6
python27-python-virtualenv	eq	13.1.0__1.el6
python27-mod_wsgi	eq	3.4__5.el6op
python27-mod_wsgi	eq	3.4__26.el6op
python27-mod_wsgi	eq	3.4__12.el6
python27-mod_wsgi	eq	3.4__11.el6
python27-python-pip	eq	1.4__7.el6op
python27-python-pip	eq	1.5.6__5.el6
python27-python-pip	eq	7.1.0__2.el6
python27-python-setuptools	eq	0.9.8__2.el6