PT-2017-6604 · Restkit · Restkit

Dstufftopen · Published 2017-08-09 · Updated 2022-05-17 · CVE-2015-2674

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Restkit (affected versions not specified)

Description The issue allows man-in-the-middle attackers to spoof TLS servers by leveraging the use of the ssl.wrap socket function in Python with the default CERT NONE value for the cert reqs argument. This enables attackers to intercept and alter communication between the client and server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2015-2674

GHSA-P9CV-HRXR-FXX8

PYSEC-2017-69

Affected Products

Restkit

References · 11

• https://ubuntu.com/security/CVE-2015-2674 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-2674 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2674 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2674 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-69 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9cv-hrxr-fxx8 · Vendor Advisory
• https://github.com/benoitc/restkit/issues/140 · Note
• https://github.com/benoitc/restkit · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/restkit/PYSEC-2017-69.yaml · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1202837 · Note
• http://openwall.com/lists/oss-security/2015/03/23/7 · Note