What is GHSA-p9cv-hrxr-fxx8?

GHSA-p9cv-hrxr-fxx8 is a security advisory published by GitHub Security Advisories with Medium severity. Restkit Does Not Validate TLS certificates

Which CVE IDs does GHSA-p9cv-hrxr-fxx8 cover?

GHSA-p9cv-hrxr-fxx8 covers the following CVE IDs: CVE-2015-2674. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p9cv-hrxr-fxx8?

GHSA-p9cv-hrxr-fxx8 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-p9cv-hrxr-fxx8?

GHSA-p9cv-hrxr-fxx8 affects 1 product, including: pip/restkit:\u003c= 4.2.2.

GHSA-p9cv-hrxr-fxx8MediumCVSS 5.9

Restkit Does Not Validate TLS certificates

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 21, 2024

🔗 CVE IDs covered (1)

CVE-2015-2674 →

📋 Description

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.

🎯 Affected products1

pip/restkit:<= 4.2.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2015-2674
https://github.com/benoitc/restkit/issues/140
https://bugzilla.redhat.com/show_bug.cgi?id=1202837
http://www.openwall.com/lists/oss-security/2015/03/23/7
https://github.com/pypa/advisory-database/tree/main/vulns/restkit/PYSEC-2017-69.yaml
https://github.com/advisories/GHSA-p9cv-hrxr-fxx8