Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pw5s-1prw-vqhz
Vulnerability ID VCID-pw5s-1prw-vqhz
Aliases CVE-2014-9365
Summary The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Status Published
Exploitability 0.5
Weighted Severity 4.2
Risk 2.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-345 Insufficient Verification of Data Authenticity
System Score Found at
cvssv3 4.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9365.json
epss 0.02758 https://api.first.org/data/v1/epss?cve=CVE-2014-9365
epss 0.02758 https://api.first.org/data/v1/epss?cve=CVE-2014-9365
epss 0.02758 https://api.first.org/data/v1/epss?cve=CVE-2014-9365
epss 0.02758 https://api.first.org/data/v1/epss?cve=CVE-2014-9365
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9365.json
https://api.first.org/data/v1/epss?cve=CVE-2014-9365
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9365
1173041 https://bugzilla.redhat.com/show_bug.cgi?id=1173041
RHSA-2017:1162 https://access.redhat.com/errata/RHSA-2017:1162
RHSA-2017:1868 https://access.redhat.com/errata/RHSA-2017:1868
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9365.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.86286
EPSS Score 0.02758
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:08:35.622517+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0