CVE-2022-2996 — Improper Certificate Validation in Project Python-scciclient

CWE-295 — Improper Certificate Validation6 documents5 sources
Severity
7.4HIGHNVD
EPSS
0.2%
top 54.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Python-scciclient Project Python-scciclientDebian Python-scciclientDebian Linux
Timeline
PublishedSep 1
Latest updateSep 2

Description

A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages4 packages

▶debiandebian/python-scciclient< python-scciclient 0.12.3-2 (bookworm)

Also affects: Debian Linux 10.0

Patches

Patch: opendev.org ↗Patch: opendev.org ↗

🔴Vulnerability Details

3
OSV
python-scciclient vulnerable to Man-in-the-middle (MITM) attacks↗2022-09-02
▶
GHSA
python-scciclient vulnerable to Man-in-the-middle (MITM) attacks↗2022-09-02
▶
OSV
CVE-2022-2996: A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified↗2022-09-01
▶

📋Vendor Advisories

2
Red Hat
python-scciclient: missing server certificate verification↗2022-06-01
▶
Debian
CVE-2022-2996: python-scciclient - A flaw was found in the python-scciclient when making an HTTPS connection to a s...↗2022
▶