{"action":"Upgrade blackduck to 0.0.53 or later.","affected":[{"fixed":"0.0.53","introduced":"0.0.25"}],"component":"blackduck","cve_ids":["CVE-2020-27589"],"ecosystem":"PyPI","epss":0.01126,"exploited":false,"fixed_versions":["0.0.53"],"ghsa_id":"GHSA-f248-v4qh-x2r6","id":"tcs_01M5KGA3F16BXHK9GMN1P2AZJ0","modified_at":"2023-11-08T04:03:21.744685Z","published_at":"2020-11-06T14:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-26","https://www.optiv.com/explore-optiv-insights/source-zero/certificate-validation-disabled-black-duck-api-wrapper","https://pypi.org/project/blackduck/","https://github.com/blackducksoftware/hub-rest-api-python","https://github.com/blackducksoftware/hub-rest-api-python/pull/113/commits/273b27d0de1004389dd8cf43c40b1197c787e7cd","https://community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified","https://github.com/advisories/GHSA-f248-v4qh-x2r6"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2020-26","url":"https://osv.dev/vulnerability/PYSEC-2020-26"},{"source":"nvd","source_id":"CVE-2020-27589","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27589"}],"summary":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases."}