Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Python 安全绕过漏洞
Vulnerability Description
Python是Python软件基金会的一套开源的、面向对象的程序设计语言，该语言具有可扩展、支持模块和包、支持多种平台等特点。CPython（又名Python）是一款用C语言实现的Python解释器。 Cpython 2.7.9之前2.x版本和3.4.3之前3.x版本中的httplib、urllib、urllib2和xmlrpclib库的HTTP客户端存在安全漏洞，该漏洞源于程序访问HTTPS URL时，没有正确验证证书。攻击者可借助任意有效的证书利用该漏洞实施中间人攻击，伪造数据，欺骗SSL服务器。
CVSS Information
N/A
Vulnerability Type
N/A