CVE-2013-2037: Input Validation
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Other sources
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2037?
CVE-2013-2037 has a moderate severity as it allows man-in-the-middle attackers to spoof SSL servers due to hostname verification issues.
How do I fix CVE-2013-2037?
You can fix CVE-2013-2037 by upgrading httplib2 to version 0.10.1 or later.
Which versions of httplib2 are affected by CVE-2013-2037?
CVE-2013-2037 affects httplib2 versions 0.7.2 and 0.8, as well as all earlier versions.
What type of vulnerability is CVE-2013-2037?
CVE-2013-2037 is a vulnerability related to improper hostname verification in SSL connections.
On which operating systems is CVE-2013-2037 relevant?
CVE-2013-2037 is relevant to Ubuntu Linux versions 10.04, 12.04, 12.10, and 13.04.