GitHub Advisoryadvisory · PyPI

GHSA-p3xv-97g8-4wmj Python Swift client is vulnerable to Missing SSL Certificate Check

CRITICAL Published 2022-05-17 Modified 2025-07-07 Official page ↗
Aliases
CVE-2013-6396
Ecosystem
PyPI
Packages
python-swiftclient
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2023-08-29

Affected packages

• PyPI python-swiftclient: >= 1.0, < 2.0 → fixed in 2.0

Description

The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Related

Alias · CVE (1)

  • CVE-2013-6396 The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers,… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References