PT-2019-7137 · Python · Python Twisted

Published 2019-11-12 · Updated 2024-11-25 · CVE-2014-7143

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python Twisted version 14.0

Description The issue concerns the trustRoot in the HTTP client of Python Twisted, which is not respected. This means that the trust root, which is supposed to define the trusted certificate authorities, is not being properly considered, potentially leading to security issues.

Recommendations For Python Twisted version 14.0, consider updating to a version where this issue is fixed, as the current version does not respect the trustRoot in the HTTP client. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2014-7143

GHSA-3C45-WGJP-7V9R

PYSEC-2019-212

Affected Products

Python Twisted

References · 18

• https://ubuntu.com/security/CVE-2014-7143 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3c45-wgjp-7v9r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7143 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7143 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-212 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-7143 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7143 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-7143 · Vendor Advisory
• https://github.com/twisted/twisted · Note
• https://github.com/twisted/twisted/commit/3b5942252f5f3e45862a0e12b266ab29e243cc33 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-212.yaml · Note
• http://openwall.com/lists/oss-security/2014/09/22/2 · Note
• https://t.me/cvenotify/102523 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96135 · Note