CVE-2013-2037

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602Issue Tracking, Mailing List, Third Party Advisory
http://code.google.com/p/httplib2/issues/detail?id=282Exploit, Third Party Advisory
http://seclists.org/oss-sec/2013/q2/257Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/52179Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1948-1Third Party Advisory
https://bugs.launchpad.net/httplib2/+bug/1175272Exploit, Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706602Issue Tracking, Mailing List, Third Party Advisory
http://code.google.com/p/httplib2/issues/detail?id=282Exploit, Third Party Advisory
http://seclists.org/oss-sec/2013/q2/257Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/52179Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1948-1Third Party Advisory
https://bugs.launchpad.net/httplib2/+bug/1175272Exploit, Patch

Timeline

Published: Jan 18, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20384.3The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitr CVE-2013-20394.0Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenti CVE-2013-20403.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth CVE-2013-20413.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web CVE-2013-20423.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth CVE-2013-20434.0apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allo CVE-2013-20445.8Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary we CVE-2013-20456.5SQL injection vulnerability in lib/db.php in ownCloud Server 5.0.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL c CVE-2013-20466.5SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated use CVE-2013-20472.1The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it CVE-2013-20486.5ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via uns CVE-2013-20497.5Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static sec