CVE-2013-2100: Gentoo Portage does not verify X.509 certificates from SSL servers
(updated )
The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.
References
- bugs.gentoo.org/show_bug.cgi?id=469888
- exchange.xforce.ibmcloud.com/vulnerabilities/84315
- github.com/advisories/GHSA-8823-xphr-qw9v
- github.com/gentoo/portage
- github.com/pypa/advisory-database/tree/main/vulns/portage/PYSEC-2014-115.yaml
- nvd.nist.gov/vuln/detail/CVE-2013-2100
- security.gentoo.org/glsa/201507-16
Code Behaviors & Features
Detect and mitigate CVE-2013-2100 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →