CVE-2012-5825: Tweepy SSL Server Spoofing Vulnerability
Summary
CVE-2012-5825: Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via... Affects tweepy versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Also tracked for
- tweepy · Debian:11
The same CVE-2012-5825 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tweepy is a Python library that provides easy access to the Twitter API. It allows developers to interact with Twitter's RESTful API and perform various operations such as reading tweets, posting tweets, and accessing user information. Tweepy is widely used in Python applications for Twitter integration and social media analysis. However, Tweepy versions prior to 2.3.1 are vulnerable to an SSL server spoofing attack.
Vulnerability Detail
The vulnerability in Tweepy arises from the lack of verification of the server hostname against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This flaw enables a man-in-the-middle attacker to impersonate an SSL server by presenting an arbitrary valid certificate. By exploiting this vulnerability, an attacker can intercept and manipulate the communication between the Tweepy client and the Twitter API, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
pip install --upgrade "tweepy==2.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Tweepy to mitigate the risk of SSL server spoofing.
Conclusion
The SSL server spoofing vulnerability in Tweepy can have serious security implications for applications that rely on Tweepy for Twitter integration. It is crucial to upgrade to Tweepy version 2.3.1 or later to mitigate the risk of SSL server spoofing. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tweepy →
FAQ
Tweepy is a Python library that provides easy access to the Twitter API. It simplifies the process of interacting with Twitter's RESTful API and enables developers to build applications that leverage Twitter data.
SSL server spoofing is a type of attack where an attacker impersonates an SSL server by presenting a valid certificate for a different domain. This allows the attacker to intercept and manipulate the communication between the client and the server, potentially leading to unauthorized access or data leakage.
The SSL server spoofing vulnerability in Tweepy can enable an attacker to intercept and manipulate the communication between the Tweepy client and the Twitter API. This can lead to unauthorized access to user accounts, data leakage, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
For more information about this vulnerability, you can refer to the advisory database entry at https://github.com/pypa/advisory-database/blob/main/vulns/tweepy/PYSEC-2012-17.yaml
Related vulnerabilities
Recent vulnerabilities recorded for tweepy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
