CVE-2020-27589 Improper Certificate Validation in blackduck
The Synopsys hub-rest-api-python library fails to validate SSL certificates, allowing attackers to bypass security checks and potentially intercept traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27589?
CVE-2020-27589 is a high-severity vulnerability in n/a, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
Weakness: CWE-295
Which versions are affected by CVE-2020-27589?
3 open source packages ship an affected version, including blackduck. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
blackduck PyPI | From 0.0.25 | 0.0.53 |
blackduck PyPI | From 0.0.25 | 0.0.53 |
blackduck PyPI | From 0.0.25 | 0.0.53 |
Products include Synopsys Hub-Rest-Api-Python.
How do I fix CVE-2020-27589?
Upgrade blackduck to 0.0.53 or later.
Is CVE-2020-27589 being exploited?
There is no known exploitation of CVE-2020-27589 in the wild and no public exploit code.
Sources
Also known as GHSA-f248-v4qh-x2r6, PYSEC-2020-26.