CVE-2013-2037
Mandriva Linux Security Advisory 2013-168
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
httplib2 0.7.2, 0.8 y anteriores, despues de la conexión inicial, no verifica que el hostname del servidor es igual al nombre de dominio en el Common Name (CN) del asunto o el campo subjectAltName del certificado X.509, lo cual permite a atacantes man-in-the-middle falsear servidores SSL a través de un certificado válido arbitrario.
It was discovered that httplib2 only validated SSL certificates on the first request to a connection, and didn't report validation failures on subsequent requests. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could possibly be exploited in certain scenarios to alter or compromise confidential information in applications that used the httplib2 library.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-02-19 CVE Reserved
- 2013-05-28 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602 | Issue Tracking | |
| http://seclists.org/oss-sec/2013/q2/257 | Mailing List |
|
| http://www.securityfocus.com/bid/52179 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| http://code.google.com/p/httplib2/issues/detail?id=282 | 2024-08-06 | |
| https://bugs.launchpad.net/httplib2/+bug/1175272 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.ubuntu.com/usn/USN-1948-1 | 2018-12-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 13.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "13.04" | - |
Affected
| ||||||
| Httplib2 Project Search vendor "Httplib2 Project" | Httplib2 Search vendor "Httplib2 Project" for product "Httplib2" | <= 0.7.2 Search vendor "Httplib2 Project" for product "Httplib2" and version " <= 0.7.2" | - |
Affected
| ||||||
| Httplib2 Project Search vendor "Httplib2 Project" | Httplib2 Search vendor "Httplib2 Project" for product "Httplib2" | 0.8 Search vendor "Httplib2 Project" for product "Httplib2" and version "0.8" | - |
Affected
| ||||||