affected:
- package:
    ecosystem: PyPI
    name: eftl
    purl: pkg:pypi/eftl
  ranges:
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - 1.0.0
  - 1.1.0
  - 1.2.0
  - 1.3.0
  - 1.3.1
aliases:
- CVE-2021-35497
details: 'The FTL Server (tibftlserver) and Docker images containing tibftlserver
  components of TIBCO Software Inc.''s TIBCO ActiveSpaces - Community Edition, TIBCO
  ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO
  FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition,
  TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL -
  Enterprise Edition contain a vulnerability that theoretically allows a non-administrative,
  authenticated FTL user to trick the affected components into creating illegitimate
  certificates. These maliciously generated certificates can be used to enable man-in-the-middle
  attacks or to escalate privileges so that the malicious user has administrative
  privileges. Affected releases are TIBCO Software Inc.''s TIBCO ActiveSpaces - Community
  Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces
  - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO
  ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and
  4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0,
  6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1,
  6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions
  6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community
  Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO
  eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1,
  and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0,
  6.5.0, 6.6.0, 6.6.1, and 6.7.0.'
id: PYSEC-2021-881
modified: '2024-11-21T14:22:45.803448Z'
published: '2021-10-05T18:15:00Z'
references:
- type: ADVISORY
  url: https://www.tibco.com/services/support/advisories
- type: ADVISORY
  url: https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497
severity:
- score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3
withdrawn: '2024-11-22T04:37:03Z'