GitHub Advisoryadvisory · PyPI
GHSA-w6q2-48ch-fj26 Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation
MEDIUM
Official page ↗
- Aliases
- CVE-2023-25392
- Ecosystem
- PyPI
- Packages
- bigflow
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-295
- Reviewed
- 2023-04-10
Affected packages
• PyPI bigflow: < 1.6.0 → fixed in 1.6.0
Description
Allegro Tech BigFlow prior to 1.6.0 is vulnerable to Missing SSL Certificate Validation.
Related
Alias · CVE (1)
- CVE-2023-25392 Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. vulnerability
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-25392 advisory
- https://github.com/allegro/bigflow/pull/357 web
- https://github.com/allegro/bigflow/commit/4ce197ff99bd38693dea59ab5e9b781fbcef4276 web
- https://github.com/allegro/bigflow/commit/7e956661f76907594e8c82e8fb0af76dbea2a0fc web
- https://github.com/allegro/bigflow package
- https://lutrasecurity.com/en/articles/cve-2023-25392 web