Unscored CVE-2013-2073 EUVD-2013-2052GHSA-7m2p-hrg9-pw87

Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transife…

Published May 2, 2014 · Updated Aug 6, 2024 · Assigned by redhat

Package: transifex-client Ecosystem: Debian

Description

Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 11	transifex-client	0.9-1	—

References

https://bugzilla.redhat.com/show_bug.cgi?id=952194
[oss-security] 20130522 CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) mailing-list
http://blog.transifex.com/post/51072109836/new-version-of-the-transifex-client-has-been-released