mailing list archives
Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9)
From: cve-assign () mitre org
Date: Sun, 15 Dec 2013 15:19:54 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE-----
The way certificate check was implemented to fix CVE-2013-2073 was
incorrect (check was done on "probe" connection, but not the actual
connection used to transfer data).
This should get a new CVE.
To have two CVEs assigned in response to two different patches for the
same security problem, it's generally necessary for the first patch to
fix some aspect of the problem. If the first patch accomplished
nothing, a total of only one CVE is used.
Here, it seems that the first patch might help with a situation in
which the attacker doesn't have complete man-in-the-middle access, but
the attacker can replace the server. In that case, the attacker
perhaps can't avoid having the probe connection and the later
connection go to the same server. Because of that, checking only the
probe connection might have a security benefit.
(https://github.com/transifex/transifex-client/issues/42 says "MITM
attacker should be able to steal all transferred data by allowing
"probe" connection opened by verify_ssl to connect to the real
transifex server and only intercept subsequent urllib2 connection.")
Use CVE-2013-7110 for the vulnerability in the "actual connection used
to transfer data."
If the above analysis is incorrect, and there are absolutely no cases
in which the original patch had any security benefit, we will reject
one of the two CVEs.
CVE assignment team, MITRE CVE Numbering Authority
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
-----END PGP SIGNATURE-----