CVE-2014-9365

CVE-2014-9365 describes a critical vulnerability in Python's HTTP client libraries (httplib, urllib, urllib2, xmlrpclib) in versions 2.x prior to 2.7.9 and 3.x prior to 3.4.3. These libraries failed to properly validate HTTPS server certificates, specifically by not checking against a trust store or verifying hostname matching in the certificate's Common Name or subjectAltName fields. This oversight allows man-in-the-middle attackers to spoof SSL servers using any valid certificate, potentially leading to information disclosure and data manipulation. The vulnerability carries a CVSS score of 5.8 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and potentially impacting confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score of 33/100 still highlights a moderate risk. Currently, there is no evidence of active exploitation, and no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered significant attention from researchers or the public.