CVE-2013-2191
No CVSS score yet. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in python-bugzilla 0.9.0.
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- opensuse:opensuse
- python_bugzilla_project:python-bugzilla
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2q4h-27m7-rj67 | PyPI | python-bugzilla | <0.9.0 | 0.9.0 |
| PYSEC-2014-88 | PyPI | python-bugzilla | <0.9.0 | 0.9.0 |
References
- http://lists.opensuse.org/opensuse-updates/2013-07/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2013-07/msg00026.html
- http://www.openwall.com/lists/oss-security/2013/06/19/6
- https://bugzilla.redhat.com/show_bug.cgi?id=951594
- https://git.fedorahosted.org/cgit/python-bugzilla.git/commit/?id=a782282ee479ba4cc1b8b1d89700ac630ba83eef