PyPI/txaws CVE-2017-1000007: medium 5.9, EPSS 0.75%

txAWS AWSServiceEndpoint defaults to not verifying server certificates

Action: Upgrade txaws to 0.4.0 or later.

pip install txaws==0.4.0

Affected

Fixed versions

Sources

• osv: GHSA-cggm-52qp-wvw7
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000007
• https://github.com/twisted/txaws/issues/24
• https://github.com/twisted/txaws/pull/26
• https://github.com/twisted/txaws/commit/46b66c3dc315de7b5896d60531311ec9658bc466
• https://github.com/pypa/advisory-database/tree/main/vulns/txaws/PYSEC-2017-85.yaml
• https://github.com/twisted/txaws

CVE-2017-1000007 · published 2022-05-17T02:20:12Z · modified 2024-11-18T23:02:31.402394Z · JSON