CVE-2022-2996: python-scciclient vulnerable to Man-in-the-middle (MITM) attacks
(updated )
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server’s certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.
References
- github.com/advisories/GHSA-rf3f-3p37-2qh4
- github.com/openstack-archive/python-scciclient
- github.com/pypa/advisory-database/tree/main/vulns/python-scciclient/PYSEC-2022-43152.yaml
- lists.debian.org/debian-lts-announce/2022/11/msg00006.html
- nvd.nist.gov/vuln/detail/CVE-2022-2996
- opendev.org/x/python-scciclient/commit/274dca0344b65b4ac113d3271d21c17e970a636c
Code Behaviors & Features
Detect and mitigate CVE-2022-2996 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →