CVE-2013-2037

CVSS V2 Low 2.6 CVSS V3 None
Description
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Overview
  • CVE ID
  • CVE-2013-2037
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2014-01-18T21:55:03
  • Last Modified Date
  • 2018-12-06T20:53:34
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:*:*:* 1 OR 0.7.2
cpe:2.3:a:httplib2_project:httplib2:0.8:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:H/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • HIGH
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 2.6
  • Severity
  • LOW
  • Exploitability Score
  • 4.9
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.ubuntu.com/usn/USN-1948-1 Third Party Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602 Mailing List Issue Tracking Third Party Advisory
http://seclists.org/oss-sec/2013/q2/257 Mailing List Third Party Advisory
http://code.google.com/p/httplib2/issues/detail?id=282 Exploit Third Party Advisory
https://bugs.launchpad.net/httplib2/+bug/1175272 Exploit Patch
http://www.securityfocus.com/bid/52179 Third Party Advisory VDB Entry
History
Created Old Value New Value Data Type Notes
2022-05-10 17:50:28 Added to TrackCVE
2022-12-01 21:36:27 2014-01-18T21:55Z 2014-01-18T21:55:03 CVE Published Date updated
2022-12-01 21:36:27 2018-12-06T20:53:34 CVE Modified Date updated
2022-12-01 21:36:27 Analyzed Vulnerability Status updated