The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1162 advisory.

    Python is an interpreted, interactive, object-oriented programming language that supports modules,     classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a     stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and     PostgreSQL.

    The python27 Software Collection has been upgraded to version 2.7.13, which provides a number of bug fixes     and enhancements over the previous version. For detailed changes, see the Red Hat Software Collections 2.4     Release Notes linked from the References section. (BZ#1402809, BZ#1344674, BZ#1413063)

    Security Fix(es) in the python27-python component:

    * The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification     of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw     to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

    Note: The Python standard library was updated to enable certificate verification by default. Refer to the     Knowledgebase article 2039753 linked to in the References section for further details about this change.
    (BZ#1417838)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - python: Heap overflow in zipimporter module (CVE-2016-5636)

  - python: Integer overflow in PyString_DecodeEscape results in heap-base buffer overflow (CVE-2017-1000158)

  - The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex,     Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products     allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity     Expansion (XEE) attack. (CVE-2013-1664)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - python: Heap overflow in zipimporter module (CVE-2016-5636)

  - python: Integer overflow in PyString_DecodeEscape results in heap-base buffer overflow (CVE-2017-1000158)

  - The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex,     Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products     allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity     Expansion (XEE) attack. (CVE-2013-1664)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K11068141 advisory.

  - The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka     Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the     certificate against a trust store or verify that the server hostname matches a domain name in the     subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via an arbitrary valid certificate. (CVE-2014-9365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that Python's smtplib library did not     return an exception when StartTLS failed to be     established in the SMTP.starttls() function. A man in     the middle attacker could strip out the STARTTLS     command without generating an exception on the Python     SMTP client application, preventing the establishment     of the TLS layer.(CVE-2016-0772)

  - A vulnerability was discovered in Python, in the     built-in zipimporter. A specially crafted zip file     placed in a module path such that it would be loaded by     a later 'import' statement could cause a heap overflow,     leading to arbitrary code execution.(CVE-2016-5636)

  - A flaw was found in the way the DES/3DES cipher was     used as part of the TLS/SSL protocol. A     man-in-the-middle attacker could use this flaw to     recover some plaintext data by capturing large amounts     of encrypted traffic between TLS/SSL server and client     if the communication used a DES/3DES based     ciphersuite.(CVE-2016-2183)

  - The Python standard library HTTP client modules (such     as httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers.
    A man-in-the-middle attacker could use this flaw to     hijack connections and eavesdrop or modify transferred     data.(CVE-2014-9365)

  - An integer overflow flaw was found in the way the     buffer() function handled its offset and size     arguments. An attacker able to control those arguments     could use this flaw to disclose portions of the     application memory or cause it to crash.(CVE-2014-7185)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's pop3lib's apop() method. An     attacker could use this flaw to cause denial of     service.(CVE-2018-1060)

  - The ssl.match_hostname function in the SSL module in     Python 2.6 through 3.4 does not properly handle a '\\0'     character in a domain name in the Subject Alternative     Name field of an X.509 certificate, which allows     man-in-the-middle attackers to spoof arbitrary SSL     servers via a crafted certificate issued by a     legitimate Certification Authority, a related issue to     CVE-2009-2408.(CVE-2013-4238)

  - It was found that the Python's httplib library (used by     urllib, urllib2 and others) did not properly check     HTTPConnection.putheader() function arguments. An     attacker could use this flaw to inject additional     headers in a Python application that allowed user     provided header names or values.(CVE-2016-5699)

  - CPython (aka Python) up to 2.7.13 is vulnerable to an     integer overflow in the PyString_DecodeEscape function     in stringobject.c, resulting in heap-based buffer     overflow (and possible arbitrary code     execution)(CVE-2017-1000158)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's difflib.IS_LINE_JUNK     method. An attacker could use this flaw to cause denial     of service.(CVE-2018-1061)

  - It was discovered that multiple Python standard library     modules implementing network protocols (such as httplib     or smtplib) failed to restrict sizes of server     responses. A malicious server could cause a client     using one of the affected modules to consume an     excessive amount of memory.(CVE-2013-1752)

  - A flaw was found in the way the json module handled     negative index argument passed to certain functions     (such as raw_decode()). An attacker able to control     index value passed to one of the affected functions     could possibly use this flaw to disclose portions of     the application memory.(CVE-2014-4616)

  - urllib in Python 2.x through 2.7.16 supports the     local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that     blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)

  - Python's elementtree C accelerator failed to initialise     Expat's hash salt during initialization. This could     make it easy to conduct denial of service attacks     against Expat by contructing an XML document that would     cause pathological hash collisions in Expat's internal     data structures, consuming large amounts CPU and     RAM.(CVE-2018-14647)

  - A null pointer dereference vulnerability was found in     the certificate parsing code in Python. This causes a     denial of service to applications when parsing     specially crafted certificates. This vulnerability is     unlikely to be triggered if application enables SSL/TLS     certificate validation and accepts certificates only     from trusted root certificate     authorities.(CVE-2019-5010)

  - Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is     affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization.
    The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given     hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A     specially crafted URL could be incorrectly parsed to     locate cookies or authentication data and send that     information to a different host than when parsed     correctly.(CVE-2019-9636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Python standard library HTTP client modules (such     as httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers.
    A man-in-the-middle attacker could use this flaw to     hijack connections and eavesdrop or modify transferred     data. (CVE-2014-9365)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for python is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es) :

* The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

Note: The Python standard library was updated to enable certificate verification by default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219110)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Security Fix(es) :

  - The Python standard library HTTP client modules (such as     httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers. A     man-in-the-middle attacker could use this flaw to hijack     connections and eavesdrop or modify transferred data.
    (CVE-2014-9365)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1868 advisory.

    - Fix for CVE-2016-1000110 HTTPoxy attack     Resolves: rhbz#1359164
    - Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_data()     Resolves: rhbz#1356364
    - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)       Raise an error when STARTTLS fails (upstream patch)
    - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)       Disabled HTTP header injections in httplib (upstream patch)     Resolves: rhbz#1346357

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

This update also fixes the following bugs :

  - Subprocesses used with the Eventlet library or regular     threads previously tried to close epoll file descriptors     twice, which led to an 'Invalid argument' error.
    Subprocesses have been fixed to close the file     descriptors only once.

  - When importing the readline module from a Python script,     Python no longer produces erroneous random characters on     stdout.

  - The cProfile utility has been fixed to print all values     that the '-s' option supports when this option is used     without a correct value.

  - The load_cert_chain() function now accepts 'None' as a     keyfile argument.

In addition, this update adds the following enhancements :

  - Security enhancements as described in PEP 466 have been     backported to the Python standard library, for example,     new features of the ssl module: Server Name Indication     (SNI) support, support for new TLSv1.x protocols, new     hash algorithms in the hashlib module, and many more.

  - Support for the ssl.PROTOCOL_TLSv1_2 protocol has been     added to the ssl library.

  - The ssl.SSLSocket.version() method is now available to     access information about the version of the SSL protocol     used in a connection.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory.(CVE-2013-1752)

It was discovered that the Python xmlrpclib did not restrict the size of a gzip compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data.(CVE-2014-9365)

Updated python packages fix security vulnerabilities :

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code (CVE-2014-1912).

This updates the python package to version 2.7.6, which fixes several other bugs, including denial of service flaws due to unbound readline() calls in the ftplib and nntplib modules (CVE-2013-1752).

Denial of service flaws due to unbound readline() calls in the imaplib, poplib, and smtplib modules (CVE-2013-1752).

A gzip bomb and unbound read denial of service flaw in python XMLRPC library (CVE-2013-1753).

Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).

Python before 2.7.8 is vulnerable to an integer overflow in the buffer type (CVE-2014-7185).

When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking (CVE-2014-9365).

The python-pip and tix packages was added due to missing build dependencies.

The remote host is affected by the vulnerability described in GLSA-201503-10 (Python: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Python. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
210153	RHEL 6 / 7 : python27 (RHSA-2017:1162)	Nessus	Red Hat Local Security Checks	critical
198401	RHEL 5 : python (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198372	RHEL 6 : python (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
184227	F5 Networks BIG-IP : Python vulnerability (K11068141)	Nessus	F5 Networks Local Security Checks	medium
124937	EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434)	Nessus	Huawei Local Security Checks	critical
103024	EulerOS 2.0 SP2 : python (EulerOS-SA-2017-1186)	Nessus	Huawei Local Security Checks	medium
103023	EulerOS 2.0 SP1 : python (EulerOS-SA-2017-1185)	Nessus	Huawei Local Security Checks	medium
102741	CentOS 7 : python (CESA-2017:1868)	Nessus	CentOS Local Security Checks	medium
102654	Scientific Linux Security Update : python on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	medium
102286	Oracle Linux 7 : python (ELSA-2017-1868)	Nessus	Oracle Linux Local Security Checks	critical
102104	RHEL 7 : python (RHSA-2017:1868)	Nessus	Red Hat Local Security Checks	medium
87570	Scientific Linux Security Update : python on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	critical
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
84369	Amazon Linux AMI : python27 (ALAS-2015-552)	Nessus	Amazon Linux Local Security Checks	high
82328	Mandriva Linux Security Advisory : python (MDVSA-2015:075)	Nessus	Mandriva Local Security Checks	high
82009	GLSA-201503-10 : Python: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2014-9365

critical

Tenable Plugins

critical

critical

critical

medium

critical

medium

medium

medium

medium

critical

medium

critical

high

high

high

high

medium