CVE-2013-2037: httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server host...

Security readout for executives and security teams

Applications using affected httplib2 versions may believe they are connected securely while accepting a certificate for the wrong hostname after an initial connection. A network-positioned attacker could impersonate an SSL server with any otherwise valid certificate, exposing sensitive traffic to interception or tampering. Exposure is most likely in legacy Python applications, OS packages, or embedded tools still using httplib2 0.8 or earlier for HTTPS requests. The bundle does not identify specific downstream products beyond httplib2. Treat this as a legacy dependency risk with meaningful confidentiality impact. It is not listed as actively exploited in KEV, but affected systems can lose HTTPS identity assurance under network interception conditions. Mitigation focus: Inventory Python applications and OS packages for httplib2 0.8 or earlier.; Apply vendor-supported httplib2 updates from upstream or distribution advisories.; Consult Ubuntu, Debian, and upstream httplib2 guidance for fixed package details..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.