GitHub Advisoryadvisory · PyPI

GHSA-f9q5-46qg-74x4 PyWBEM TOCTOU vulnerability in certificate validation

HIGH Published 2022-05-17 Modified 2024-10-25 Official page ↗
Aliases
CVE-2013-6418
Ecosystem
PyPI
Packages
pywbem
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2024-04-29

Affected packages

• PyPI pywbem: < 0.8.1 → fixed in 0.8.1

Description

PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.

Related

Alias · CVE (1)

  • CVE-2013-6418 PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References