CVE-2017-1000007: Infoleak
First published: Thu Jul 13 2017(Updated: )
txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Twistedmatrix Txaws | ||
| pip/txaws | <0.4.0 | 0.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/twisted/txaws/issues/24
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000007
- https://github.com/twisted/txaws/pull/26
- https://github.com/twisted/txaws/commit/46b66c3dc315de7b5896d60531311ec9658bc466
- https://github.com/advisories/GHSA-cggm-52qp-wvw7 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/txaws/PYSEC-2017-85.yaml
Frequently Asked Questions
What is the severity of CVE-2017-1000007?
CVE-2017-1000007 is classified as a high severity vulnerability due to its potential for MitM attacks and sensitive data exposure.
How do I fix CVE-2017-1000007?
To mitigate CVE-2017-1000007, upgrade to txAWS version 0.4.0 or later where the certificate verification issue has been addressed.
What type of attacks does CVE-2017-1000007 make my system vulnerable to?
CVE-2017-1000007 leaves systems vulnerable to man-in-the-middle (MitM) attacks and can lead to information disclosure.
Which software is affected by CVE-2017-1000007?
CVE-2017-1000007 affects all current versions of txAWS, specifically those below version 0.4.0.
What happens if CVE-2017-1000007 is exploited?
Exploitation of CVE-2017-1000007 can lead to attackers intercepting and potentially altering sensitive data communicated between users and services.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-cggm-52qp-wvw7
- alias/CVE-2017-1000007
- agent/last-modified-date
- agent/references
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- vendor/twistedmatrix
- canonical/twistedmatrix txaws
- package-manager/pip