CVE-2013-7110 Transifex command-line client has improper certificate validation
MediumCVSS 4.3
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi transifex-client(PyPI) | < 0.10 | 0.10 |
| pypi transifex-client(PyPI) | = 0.1 | No fix listed |
| pypi transifex-client(PyPI) | = 0.2 | No fix listed |
| pypi transifex-client(PyPI) | = 0.2.1 | No fix listed |
| pypi transifex-client(PyPI) | = 0.3 | No fix listed |
| pypi transifex-client(PyPI) | = 0.4 | No fix listed |
| pypi transifex-client(PyPI) | = 0.4.1 | No fix listed |
| pypi transifex-client(PyPI) | = 0.5 | No fix listed |
| pypi transifex-client(PyPI) | = 0.5.1 | No fix listed |
| pypi transifex-client(PyPI) | = 0.5.2 | No fix listed |
| pypi transifex-client(PyPI) | = 0.6 | No fix listed |
| pypi transifex-client(PyPI) | = 0.6.1 | No fix listed |
| pypi transifex-client(PyPI) | = 0.7 | No fix listed |
| pypi transifex-client(PyPI) | = 0.7.2 | No fix listed |
| pypi transifex-client(PyPI) | = 0.7.3 | No fix listed |
| pypi transifex-client(PyPI) | = 0.8 | No fix listed |
| pypi transifex-client(PyPI) | = 0.9 | No fix listed |
| pypi transifex-client(PyPI) | = 0.9.1 | No fix listed |
| pypi transifex-client(PyPI) | < 0.11.0 | 0.11.0 |
| pypi transifex-client(PyPI) | = 0.10 | No fix listed |
| pypi transifex-client(PyPI) | = 0.11.beta | No fix listed |
| pypi transifex-client(PyPI) | = 0.11b3 | No fix listed |
| ubuntu/transifex-client(Ubuntu:22.04) | All versions | No fix listed |
| debian/transifex-client(Debian:11) | < 0.10-1 | 0.10-1 |
| transifex | <= 0.9 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| transifex | = 0.1 | No fix listed |
| transifex | = 0.2 | No fix listed |
| transifex | = 0.3 | No fix listed |
| transifex | = 0.4 | No fix listed |
| transifex | = 0.5 | No fix listed |
| transifex | = 0.6 | No fix listed |
| transifex | = 0.7 | No fix listed |
| transifex | = 0.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking
- github.com patch
- github.com
- github.com product
- [oss-security] 20131213 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) mailing-list
- [oss-security] 20131215 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) mailing-list
- github.com vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- security-tracker.debian.org vendor-advisory