Description
Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | transifex-client | 0.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | transifex-client | No fix yet | — |
| Ubuntu 20.04 LTS | transifex-client | No fix yet | — |
| Ubuntu 18.04 LTS | transifex-client | No fix yet | — |
| Ubuntu 16.04 LTS | transifex-client | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | transifex-client | < 0.10 | 0.10 | GHSA-jf99-2rj4-jxrm |
| PyPI | transifex-client | < 0.11.0 | 0.11.0 | PYSEC-2014-72 |
References
- [oss-security] 20131213 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) mailing-list
- https://github.com/transifex/transifex-client/issues/42
- [oss-security] 20131215 Re: CVE-2013-2073 transifex-client: Does not validate HTTPS server certificate (fixed in transifex-client v0.9) mailing-list