CVE-2015-2674 Restkit Does Not Validate TLS certificates
MediumCVSS 5.9
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi restkit(PyPI) | <= 4.2.2 | No fix listed |
| pypi restkit(PyPI) | = 1.0.0 | No fix listed |
| pypi restkit(PyPI) | = 1.1.0 | No fix listed |
| pypi restkit(PyPI) | = 1.1.1 | No fix listed |
| pypi restkit(PyPI) | = 1.1.2 | No fix listed |
| pypi restkit(PyPI) | = 1.1.3 | No fix listed |
| pypi restkit(PyPI) | = 1.2.0 | No fix listed |
| pypi restkit(PyPI) | = 1.2.1 | No fix listed |
| pypi restkit(PyPI) | = 1.3.0 | No fix listed |
| pypi restkit(PyPI) | = 1.3.1 | No fix listed |
| pypi restkit(PyPI) | = 2.0.0 | No fix listed |
| pypi restkit(PyPI) | = 2.0.1 | No fix listed |
| pypi restkit(PyPI) | = 2.0.2 | No fix listed |
| pypi restkit(PyPI) | = 2.0.4 | No fix listed |
| pypi restkit(PyPI) | = 2.0.5 | No fix listed |
| pypi restkit(PyPI) | = 2.1.0 | No fix listed |
| pypi restkit(PyPI) | = 2.1.1 | No fix listed |
| pypi restkit(PyPI) | = 2.1.2 | No fix listed |
| pypi restkit(PyPI) | = 2.1.3 | No fix listed |
| pypi restkit(PyPI) | = 2.1.4 | No fix listed |
| pypi restkit(PyPI) | = 2.1.5 | No fix listed |
| pypi restkit(PyPI) | = 2.1.6 | No fix listed |
| pypi restkit(PyPI) | = 2.1.7 | No fix listed |
| pypi restkit(PyPI) | = 2.2.0 | No fix listed |
| pypi restkit(PyPI) | = 2.2.1 | No fix listed |
Show 31 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi restkit(PyPI) | = 2.2.2 | No fix listed |
| pypi restkit(PyPI) | = 2.2.3 | No fix listed |
| pypi restkit(PyPI) | = 2.2.4 | No fix listed |
| pypi restkit(PyPI) | = 2.3.0 | No fix listed |
| pypi restkit(PyPI) | = 2.3.1 | No fix listed |
| pypi restkit(PyPI) | = 2.3.2 | No fix listed |
| pypi restkit(PyPI) | = 2.3.3 | No fix listed |
| pypi restkit(PyPI) | = 3.0.0 | No fix listed |
| pypi restkit(PyPI) | = 3.0.1 | No fix listed |
| pypi restkit(PyPI) | = 3.0.2 | No fix listed |
| pypi restkit(PyPI) | = 3.0.3 | No fix listed |
| pypi restkit(PyPI) | = 3.0.4 | No fix listed |
| pypi restkit(PyPI) | = 3.2.0 | No fix listed |
| pypi restkit(PyPI) | = 3.2.1 | No fix listed |
| pypi restkit(PyPI) | = 3.2.2 | No fix listed |
| pypi restkit(PyPI) | = 3.2.3 | No fix listed |
| pypi restkit(PyPI) | = 3.3.0 | No fix listed |
| pypi restkit(PyPI) | = 3.3.1 | No fix listed |
| pypi restkit(PyPI) | = 3.3.2 | No fix listed |
| pypi restkit(PyPI) | = 4.0.0 | No fix listed |
| pypi restkit(PyPI) | = 4.1.0 | No fix listed |
| pypi restkit(PyPI) | = 4.1.1 | No fix listed |
| pypi restkit(PyPI) | = 4.1.2 | No fix listed |
| pypi restkit(PyPI) | = 4.1.3 | No fix listed |
| pypi restkit(PyPI) | = 4.1.4 | No fix listed |
| pypi restkit(PyPI) | = 4.1.5 | No fix listed |
| pypi restkit(PyPI) | = 4.2.0 | No fix listed |
| pypi restkit(PyPI) | = 4.2.1 | No fix listed |
| pypi restkit(PyPI) | = 4.2.2 | No fix listed |
| pypi restkit(PyPI) | >= 1.0.0 | No fix listed |
| restkit | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- github.com product
- github.com
- [oss-security] 20150323 Re: Assign a CVE for Python's restkit Please mailing-list vdb-entry
- github.com vendor-advisory