SSL Certificate Verification Bypass in Tweepy Package
Summary
DEBIAN-CVE-2012-5825: Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via... Affects tweepy versions < 3.1.0-2. Fixed in 3.1.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tweepy is a popular Python library that provides an easy-to-use interface for accessing the Twitter API. It allows developers to interact with Twitter's features, such as posting tweets, following users, and retrieving user data. However, Tweepy has a vulnerability that affects its ability to verify SSL certificates, which can expose users to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability arises from Tweepy's failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows attackers to spoof SSL servers using arbitrary valid certificates, potentially leading to unauthorized access to sensitive data transmitted over SSL connections. The issue is rooted in the use of the Python httplib library, which does not enforce strict hostname verification.
How To Fix
Minimum fixed version
3.1.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tweepyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement custom SSL verification logic in their applications to ensure that the server's hostname is validated against the certificate. However, this approach requires additional coding and may not be as secure as updating to the patched version.
Conclusion
The vulnerability in the Tweepy package poses a significant risk due to improper SSL certificate verification, allowing potential man-in-the-middle attacks. Users are strongly advised to update to the latest patched version to secure their applications. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to issues without requiring code access.
See every vulnerability recorded for tweepy →
FAQ
The vulnerability allows man-in-the-middle attackers to spoof SSL servers due to improper hostname verification in SSL certificates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, attackers could intercept sensitive data, such as authentication tokens and user credentials, leading to unauthorized access to user accounts.
Yes, the vulnerability is fixed in version 3.1.0-2 and later. Users should update to this version to mitigate the risk.
If immediate updates are not possible, consider implementing custom SSL verification as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for tweepy.
