CVE-2020-27589: Improper Certificate Validation in blackduck
Summary
CVE-2020-27589: Improper Certificate Validation in blackduck. Affects blackduck versions >= 0.0.25, < 0.0.53. Fixed in 0.0.53. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The blackduck package is a Python library that provides functionality for interacting with the Synopsys hub-rest-api. It allows users to perform various operations such as scanning and managing software components. The package is available on PyPI and versions 0.0.25 to 0.0.52 are affected by a vulnerability related to SSL certificate validation.
Vulnerability Detail
The vulnerability (CVE-2020-27589) in blackduck arises from the improper validation of SSL certificates in certain cases. This means that the package does not properly verify the authenticity of SSL certificates, potentially allowing for man-in-the-middle attacks or other security breaches. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5. It is important to note that this vulnerability was identified and reviewed by GitHub.
How To Fix
Minimum fixed version
0.0.53
This is the first release that contains the fix.
pip install --upgrade "blackduck==0.0.53"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed version as soon as possible.
Conclusion
In conclusion, the blackduck package versions 0.0.25 to 0.0.52 are vulnerable to improper certificate validation, which can lead to potential security breaches. It is highly recommended to update to version 0.0.53 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for blackduck →
FAQ
The vulnerability could potentially allow attackers to intercept and manipulate network traffic, leading to unauthorized access or data leakage.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
No, only versions 0.0.25 to 0.0.52 of the blackduck package are affected. Version 0.0.53 and later have the necessary fixes.
There are no known public exploits for this vulnerability at the moment. However, it is still important to update to the fixed version to ensure security.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-f248-v4qh-x2r6/GHSA-f248-v4qh-x2r6.json
