CVE-2013-2191: python-bugzilla X.509 Certificate Validation Bypass
Summary
CVE-2013-2191: python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate. Affects python-bugzilla versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-bugzilla is a Python library that provides an interface to interact with Bugzilla servers. It allows users to query, create, and update Bugzilla bugs programmatically. The library is commonly used by developers and organizations to automate bug tracking and management processes. However, prior to version 0.9.0, python-bugzilla did not properly validate X.509 certificates, making it susceptible to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability (CVE-2013-2191) in python-bugzilla arises from its failure to validate X.509 certificates. This oversight enables attackers to perform man-in-the-middle attacks by spoofing Bugzilla servers using crafted certificates. By intercepting and modifying network traffic, an attacker can potentially gain unauthorized access to sensitive information or manipulate bug tracking data. This vulnerability poses a significant risk to the integrity and security of bug tracking systems relying on python-bugzilla.
How To Fix
Latest published version: 3.3.0 as of 22 Oct 2026
pip install --upgrade "python-bugzilla==3.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
pip install --upgrade "python-bugzilla==0.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability (CVE-2013-2191) in python-bugzilla allows for X.509 certificate validation bypass, enabling man-in-the-middle attacks. To mitigate this risk, users should upgrade to python-bugzilla version 0.9.0 or later. It is recommended to regularly check for vulnerabilities in your application using tools like Vulert (https://vulert.com) to ensure the security of your software.
See every vulnerability recorded for python-bugzilla →
FAQ
python-bugzilla is a Python library that provides an interface to interact with Bugzilla servers. It allows users to automate bug tracking and management processes.
The vulnerability allows attackers to spoof Bugzilla servers, potentially leading to unauthorized access to sensitive information or manipulation of bug tracking data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to python-bugzilla version 0.9.0 or later.
You can find more information about this vulnerability in the official advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/python-bugzilla/PYSEC-2014-88.yaml
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
