PT-2019-7137 · Python · Python Twisted

CVE-2014-7143 · Publicado 2019-11-12 · Atualizado 2024-11-25

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python Twisted version 14.0

Description The issue concerns the trustRoot in the HTTP client of Python Twisted, which is not respected. This means that the trust root, which is supposed to define the trusted certificate authorities, is not being properly considered, potentially leading to security issues.

Recommendations For Python Twisted version 14.0, consider updating to a version where this issue is fixed, as the current version does not respect the trustRoot in the HTTP client. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2014-7143

GHSA-3C45-WGJP-7V9R

PYSEC-2019-212

Produtos afetados

Python Twisted

Referências · 18

• https://github.com/twisted/twisted · Nota
• https://github.com/twisted/twisted/commit/3b5942252f5f3e45862a0e12b266ab29e243cc33 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-212.yaml · Nota
• https://osv.dev/vulnerability/CVE-2014-7143 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-7143 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-7143 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/09/17/4 · Nota
• https://t.me/cvenotify/102523 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2014/09/22/2 · Nota
• https://cve.org/CVERecord?id=CVE-2014-7143 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96135 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7143 · Aviso do Fabricante
• https://github.com/advisories/GHSA-3c45-wgjp-7v9r · Nota
• https://ubuntu.com/security/CVE-2014-7143 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7143 · Aviso do Fabricante