CVE-2012-5825: Tweepy does not verify SSL Certificate

May 17, 2022 (updated November 18, 2024)

Tweepy does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.

References

exchange.xforce.ibmcloud.com/vulnerabilities/79831
github.com/advisories/GHSA-pwx5-xg7g-wpc5
github.com/pypa/advisory-database/tree/main/vulns/tweepy/PYSEC-2012-17.yaml
github.com/tweepy/tweepy
github.com/tweepy/tweepy/issues/279
github.com/tweepy/tweepy/pull/400
nvd.nist.gov/vuln/detail/CVE-2012-5825

Code Behaviors & Features

Detect and mitigate CVE-2012-5825 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →