CVE-2024-41124: Cleartext Transmission of Sensitive Information via HTTP urls in puncia
Summary
CVE-2024-41124: [PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in API_URLS. Affects puncia versions < 0.21. Fixed in 0.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Puncia is a Python package available on PyPI that is used for communication. It contains the API_URLS module, which is responsible for handling API communication. However, the package is vulnerable to cleartext transmission of sensitive information via HTTP URLs in the API_URLS module.
Vulnerability Detail
The vulnerability arises from the usage of HTTP instead of HTTPS for communication in the API_URLS module. This can lead to various security issues such as eavesdropping, data tampering, unauthorized data access, and man-in-the-middle (MITM) attacks. An attacker can intercept the communication and gain access to sensitive information being transmitted.
How To Fix
Latest published version: 0.41.0 as of 23 Oct 2026
pip install --upgrade "puncia==0.41.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.21
This is the first release that contains the fix.
pip install --upgrade "puncia==0.21"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to manually modify the URLs in the API_URLS module to use HTTPS instead of HTTP. For example, if the original URL is 'http://example.com/api', it should be changed to 'https://example.com/api'. However, this workaround is not recommended as it requires manual intervention and may not provide a comprehensive solution.
Conclusion
The puncia package is vulnerable to cleartext transmission of sensitive information via HTTP URLs in the API_URLS module. This can lead to various security risks such as eavesdropping, data tampering, unauthorized data access, and man-in-the-middle attacks. It is crucial to update the module to utilize HTTPS for secure communication and enforce HTTPS throughout the package.
See every vulnerability recorded for puncia →
FAQ
The impact of this vulnerability includes the risk of eavesdropping, data tampering, unauthorized data access, and man-in-the-middle (MITM) attacks. It can potentially expose sensitive information being transmitted.
An attacker can exploit this vulnerability by intercepting the communication between the package and the API server. They can then eavesdrop on the transmitted data, tamper with it, or gain unauthorized access to sensitive information.
Yes, the vulnerability can be fixed by updating the API_URLS module to utilize HTTPS instead of HTTP for communication. It is recommended to enforce HTTPS throughout the entire package.
A possible workaround is to manually modify the URLs in the API_URLS module to use HTTPS instead of HTTP. However, this workaround is not recommended as it may not provide a comprehensive solution.
The severity of this vulnerability is rated as low, with a CVSS score of 3.8.
