CVE-2022-2996

python-scciclient: missing server certificate verification

Published Sep 1, 2022 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3180-1 python-scciclient security update
EUVD EUVD EUVD-2022-0408 A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.
Github GHSA Github GHSA GHSA-rf3f-3p37-2qh4 python-scciclient vulnerable to Man-in-the-middle (MITM) attacks
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 3, 2024, 12:52 AM
Reserved
Aug 25, 2022, 12:00 AM
Status
Modified
Published
Sep 1, 2022, 6:15 PM
Modified
Jun 17, 2026, 4:42 AM
Severity
Moderate
Public date
Jun 1, 2022, 12:00 AM