GitHub Advisoryadvisory · PyPI
GHSA-cggm-52qp-wvw7 txAWS AWSServiceEndpoint defaults to not verifying server certificates
HIGH
Official page ↗
- Aliases
- CVE-2017-1000007
- Ecosystem
- PyPI
- Packages
- txaws
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2024-02-23
Affected packages
• PyPI txaws: < 0.4.0 → fixed in 0.4.0
Description
txAWS fails to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
Related
Alias · CVE (1)
- CVE-2017-1000007 txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000007 advisory
- https://github.com/twisted/txaws/issues/24 web
- https://github.com/twisted/txaws/pull/26 web
- https://github.com/twisted/txaws/commit/46b66c3dc315de7b5896d60531311ec9658bc466 web
- https://github.com/pypa/advisory-database/tree/main/vulns/txaws/PYSEC-2017-85.yaml web
- https://github.com/twisted/txaws package