CVE-2012-5825CWE-20

CVE-2012-5825

High · published November 5, 2012

CVSS v3.1
7.4
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00609 · 48.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2012-11-05T03:55Z
Affected products (1)
ProductVersionsFixed in
tweepy/tweepy< 3.0.03.0.0
References (4)
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf · [email protected]https://exchange.xforce.ibmcloud.com/vulnerabilities/79831 · [email protected]http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf · af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/79831 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 NOV 22:00Z
    Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which…
    cvelistv5