GitHub Advisoryadvisory · PyPI

GHSA-rwcj-7jjp-4w38 [PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

LOW Published 2024-07-19 Modified 2024-07-22 Official page ↗

Aliases: CVE-2024-41124
Ecosystem: PyPI
Packages: puncia
Severity: Low
CVSS vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Weaknesses: CWE-311, CWE-319
Reviewed: 2024-07-19

Affected packages

• PyPI puncia: < 0.21 → fixed in 0.21

Description

Impact `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. References ISSUE PATCH

Alias · CVE (1)

CVE-2024-41124 Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. vulnerability

Weakness · CWE (2)

CWE-311 Missing Encryption of Sensitive Data weakness
CWE-319 Cleartext Transmission of Sensitive Information weakness

References

https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38 web
https://nvd.nist.gov/vuln/detail/CVE-2024-41124 advisory
https://github.com/ARPSyndicate/puncia/issues/8 web
https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd web
https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526 web
https://github.com/ARPSyndicate/puncia package