PT-2014-2570 · Python · Python-Bugzilla

Florian Weimer · Published 2014-02-08 · Updated 2024-07-12 · CVE-2013-2191

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-bugzilla versions prior to 0.9.0

Description The issue allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate because it does not validate X.509 certificates.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-2191

GHSA-2Q4H-27M7-RJ67

OPENSUSE-SU-2024:10058-1

OPENSUSE-SU-2024:14135-1

PYSEC-2014-88

Affected Products

Python-Bugzilla

References · 15

• https://git.fedorahosted.org/cgit/python-bugzilla.git/commit/?id=a782282ee479ba4cc1b8b1d89700ac630ba83eef · Patch
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00025.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2191 · Security Note
• https://osv.dev/vulnerability/GHSA-2q4h-27m7-rj67 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-88 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14135-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10058-1 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/python-bugzilla/PYSEC-2014-88.yaml · Note
• https://github.com/python-bugzilla/python-bugzilla/commit/a782282ee479ba4cc1b8b1d89700ac630ba83eef · Note
• https://github.com/python-bugzilla/python-bugzilla · Note
• http://openwall.com/lists/oss-security/2013/06/19/6 · Note
• https://lists.fedorahosted.org/pipermail/python-bugzilla/2013-June/000104.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=951594 · Note
• https://suse.com/security/cve/CVE-2013-2191 · Note