PT-2020-16710 · Synopsys · Hub-Rest-Api-Python

Published 2020-11-06 · Updated 2021-04-20 · CVE-2020-27589

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Synopsys hub-rest-api-python (aka blackduck on PyPI) versions 0.0.25 through 0.0.52

Description The issue is related to the failure to validate SSL certificates in certain cases. This could potentially lead to security risks, as it may allow for man-in-the-middle attacks or other types of exploitation.

Recommendations For versions 0.0.25 through 0.0.52, consider updating to a version that properly validates SSL certificates to mitigate the risk. As a temporary workaround, restrict the use of the affected API to minimize the risk of exploitation.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-27589

GHSA-F248-V4QH-X2R6

PYSEC-2020-26

Affected Products

Hub-Rest-Api-Python

References · 17

• 🔥 https://optiv.com/explore-optiv-insights/source-zero/certificate-validation-disabled-black-duck-api-wrapper · Exploit
• https://github.com/blackducksoftware/hub-rest-api-python/pull/113/commits/273b27d0de1004389dd8cf43c40b1197c787e7cd · Patch
• https://community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27589 · Security Note
• https://osv.dev/vulnerability/GHSA-f248-v4qh-x2r6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27589 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-26 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/blackduck/PYSEC-2020-26.yaml · Note
• https://github.com/blackducksoftware/hub-rest-api-python · Note
• https://github.com/blackducksoftware/hub-rest-api-python/pull/113 · Note
• https://github.com/blackducksoftware/hub-rest-api-python/commit/0a25777117515b8b4ff287a98f57837a8c6bdbdb · Note
• https://pypi.org/project/blackduck · Note
• https://t.me/cvenotify/5469 · Telegram Post
• https://t.me/cvenotify/5246 · Telegram Post
• https://t.me/cvenotify/5261 · Telegram Post