PT-2019-6840 · Cumin · Cumin

Trevor Mckay · Published 2019-12-30 · Updated 2020-01-10 · CVE-2013-0264

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cumin (affected versions not specified)

Description An import error in Cumin, introduced during code refactoring in revision 5310, causes server certificate validation to be disabled when connecting to Aviary servers. This occurs even when the installed system packages support validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2013-0264

Affected Products

Cumin

References · 4

• https://access.redhat.com/security/cve/cve-2013-0264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0264 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0264 · Vendor Advisory
• https://t.me/cibsecurity/8923 · Telegram Post