id: PYSEC-2014-72
details: 'Transifex command-line client before 0.10 does not validate X.509 certificates
  for data transfer connections, which allows man-in-the-middle attackers to spoof
  a Transifex server via an arbitrary certificate.  NOTE: this vulnerability exists
  because of an incomplete fix for CVE-2013-2073.'
affected:
- package:
    name: transifex-client
    ecosystem: PyPI
    purl: pkg:pypi/transifex-client
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.11.0
  versions:
  - "0.1"
  - "0.10"
  - 0.11.beta
  - 0.11b3
  - "0.2"
  - 0.2.1
  - "0.3"
  - "0.4"
  - 0.4.1
  - "0.5"
  - 0.5.1
  - 0.5.2
  - "0.6"
  - 0.6.1
  - "0.7"
  - 0.7.2
  - 0.7.3
  - "0.8"
  - "0.9"
  - 0.9.1
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/12/15/3
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/12/13/5
- type: REPORT
  url: https://github.com/transifex/transifex-client/issues/42
- type: ADVISORY
  url: https://github.com/advisories/GHSA-jf99-2rj4-jxrm
aliases:
- CVE-2013-7110
- GHSA-jf99-2rj4-jxrm
modified: "2021-07-25T23:34:56.578427Z"
published: "2014-05-02T01:59:00Z"