PT-2017-6604 · Restkit · Restkit

Dstufftopen · Publicado 2017-08-09 · Atualizado 2022-05-17 · CVE-2015-2674

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Restkit (affected versions not specified)

Description The issue allows man-in-the-middle attackers to spoof TLS servers by leveraging the use of the ssl.wrap socket function in Python with the default CERT NONE value for the cert reqs argument. This enables attackers to intercept and alter communication between the client and server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2015-2674

GHSA-P9CV-HRXR-FXX8

PYSEC-2017-69

Produtos afetados

Restkit

Referências · 11

• https://github.com/benoitc/restkit/issues/140 · Nota
• https://github.com/benoitc/restkit · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/restkit/PYSEC-2017-69.yaml · Nota
• https://ubuntu.com/security/CVE-2015-2674 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-2674 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-2674 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1202837 · Nota
• http://openwall.com/lists/oss-security/2015/03/23/7 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2674 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-69 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p9cv-hrxr-fxx8 · Aviso do Fabricante