Executive brief
python-bugzilla is a Python library for interacting with Bugzilla bug tracking systems. The library did not properly validate X.509 SSL certificates when connecting to Bugzilla servers, allowing attackers to impersonate legitimate servers via crafted or self-signed certificates and intercept or modify communication.
Technical details
python-bugzilla before version 0.9.0 fails to validate X.509 certificates during HTTPS connections, accepting self-signed certificates and hostname mismatches without error. This is an improper input validation vulnerability (CWE-20) in the transport layer. An attacker positioned on the network can intercept traffic and present a forged certificate to perform man-in-the-middle attacks. The vulnerability requires network-level access but no authentication or user interaction. The fix (commit a782282e) switched the transport mechanism to pycurl, which properly validates certificate hostname and chain trust, and added a --nosslverify CLI option for users to explicitly opt out of validation if needed.
Affected products
- python-bugzilla python-bugzilla before 0.9.0
Timeline
- 2013-06-19: disclosed
- 2013-06-19: patched: Fixed in version 0.9.0
- 2022-05-14: advisory