CVE-2020-27589
First published: Fri Nov 06 2020(Updated: )
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/blackduck | >=0.0.25<0.0.53 | 0.0.53 |
| Synopsys Hub REST API Python | >=0.0.25<=0.0.52 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-27589
- https://github.com/blackducksoftware/hub-rest-api-python/pull/113/commits/273b27d0de1004389dd8cf43c40b1197c787e7cd
- https://community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified
- https://github.com/blackducksoftware/hub-rest-api-python
- https://pypi.org/project/blackduck/
- https://www.optiv.com/explore-optiv-insights/source-zero/certificate-validation-disabled-black-duck-api-wrapper
- https://github.com/advisories/GHSA-f248-v4qh-x2r6 (Advisory)
- https://github.com/blackducksoftware/hub-rest-api-python/pull/113
- https://github.com/blackducksoftware/hub-rest-api-python/commit/0a25777117515b8b4ff287a98f57837a8c6bdbdb
- https://github.com/pypa/advisory-database/tree/main/vulns/blackduck/PYSEC-2020-26.yaml
- https://pypi.org/project/blackduck
Frequently Asked Questions
What is CVE-2020-27589?
CVE-2020-27589 is a vulnerability in Synopsys hub-rest-api-python (aka blackduck on PyPI) versions 0.0.25 - 0.0.52 that allows for SSL certificate validation bypass.
What is the severity of CVE-2020-27589?
The severity of CVE-2020-27589 is high, with a CVSS score of 7.5.
How does CVE-2020-27589 affect the software?
CVE-2020-27589 affects Synopsys hub-rest-api-python versions 0.0.25 - 0.0.52 and blackduck on PyPI versions 0.0.25 - 0.0.52, allowing SSL certificate validation to be bypassed.
Is there a fix for CVE-2020-27589?
Yes, the fix for CVE-2020-27589 is to upgrade to version 0.0.53 for blackduck on PyPI or Synopsys hub-rest-api-python.
Where can I find more information about CVE-2020-27589?
You can find more information about CVE-2020-27589 on the NVD (National Vulnerability Database) website and the GitHub and Synopsys community pages.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f248-v4qh-x2r6
- alias/CVE-2020-27589
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- agent/author
- package-manager/pip
- vendor/synopsys
- canonical/synopsys hub rest api python
- version/synopsys hub rest api python/0.0.25
- version/synopsys hub rest api python/0.0.52