CVE-2020-27589: SSL Certificate Validation Bypass in blackduck
Summary
CVE-2020-27589: Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases. Affects blackduck versions >= 0.0.25, < 0.0.53. Fixed in 0.0.53. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
blackduck is a Python package available on PyPI that provides a REST API client for Synopsys Hub. It allows users to interact with the Synopsys Hub REST API to manage and analyze software components. The package is widely used in various Python projects for integrating with Synopsys Hub. However, versions 0.0.25 to 0.0.52 of blackduck have a vulnerability that leads to the bypass of SSL certificate validation in certain scenarios.
Vulnerability Detail
The vulnerability in blackduck (aka Synopsys hub-rest-api-python) versions 0.0.25 to 0.0.52 allows SSL certificate validation to be bypassed under specific conditions. This means that when making requests to an HTTPS endpoint, the package does not properly verify the authenticity of the SSL certificate, potentially exposing users to man-in-the-middle attacks. Attackers could exploit this vulnerability to intercept and modify sensitive data transmitted between the client and the server, leading to potential data breaches or unauthorized access.
How To Fix
Minimum fixed version
0.0.53
This is the first release that contains the fix.
pip install --upgrade "blackduck==0.0.53"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The SSL certificate validation bypass vulnerability in blackduck versions 0.0.25 to 0.0.52 can potentially expose users to man-in-the-middle attacks and unauthorized access. It is crucial to upgrade to version 0.0.53 or later to ensure secure communication between the client and the server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for blackduck →
FAQ
blackduck is a Python package that provides a REST API client for Synopsys Hub, allowing users to manage and analyze software components.
Versions 0.0.25 to 0.0.52 of blackduck are affected by this SSL certificate validation bypass vulnerability.
The vulnerability could allow attackers to intercept and modify sensitive data transmitted between the client and the server, potentially leading to data breaches or unauthorized access.
To fix this vulnerability, it is recommended to upgrade to version 0.0.53 or later of blackduck by running the command 'pip install --upgrade blackduck'.
No specific workaround is mentioned for this vulnerability. It is advised to upgrade to the fixed version.
