CVE-2012-5825

tweepy - SSL Certificate Hostname Validation Bypass via Missing CN/subjectAltName Check

Title source: llm

Description

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/79831

Exploit x_refsource_misc

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Scores

EPSS 0.0060

EPSS Percentile 44.4%

Details

CWE

CWE-20

Status published

Products (2)

pypi/tweepy 0 - 3.0PyPI

tweepy/tweepy

Published Nov 04, 2012

Tracked Since Feb 18, 2026