—

PYSEC-2014-72

Quick fix

PYSEC-2014-72 — transifex-client: upgrade to the fixed version with the command below.

pip install --upgrade 'transifex-client>=0.11.0'

Details

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/transifex-client

Introduced in: 0Fixed in: 0.11.0

Fixpip install --upgrade 'transifex-client>=0.11.0'

References

http://www.openwall.com/lists/oss-security/2013/12/15/3[WEB]
http://www.openwall.com/lists/oss-security/2013/12/13/5[WEB]
https://github.com/transifex/transifex-client/issues/42[REPORT]
https://github.com/advisories/GHSA-jf99-2rj4-jxrm[ADVISORY]