transifex-client CVE-2013-7110 SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	64326
Class:	Design Error
CVE:	CVE-2013-7110
Remote:	Yes
Local:	No
Published:	Dec 13 2013 12:00AM
Updated:	Dec 13 2013 12:00AM
Credit:	Tomas Hoger
Vulnerable:	Transifex transifex-client 0.9 Transifex transifex-client 0.8
Not Vulnerable:	Transifex transifex-client 0.10

transifex-client CVE-2013-7110 SSL Certificate Validation Security Bypass Vulnerability

transifex-client is prone to a security-bypass vulnerability.

An attacker can exploit this issue to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

transifex-client versions prior to 0.10 are vulnerable.

Note: This issue is the result of an incomplete fix for the issue described in BID 60081 (transifex-client CVE-2013-2073 SSL Certificate Validation Security Bypass Vulnerability).

transifex-client CVE-2013-7110 SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available tools to exploit this issue.

transifex-client CVE-2013-7110 SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

transifex-client CVE-2013-7110 SSL Certificate Validation Security Bypass Vulnerability

References:

• Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate ( (cve-assign)
  
• transifex-client Homepage (Transifex)
  
• transifex-client: insufficient CVE-2013-2073 fix (Transifex)
  
• Use urllib3 for the API calls (Transifex)