Restkit Does Not Validate TLS certificates

2022-05-1701:59:05

Google

osv.dev

0.001 Low

EPSS

Percentile

47.9%

JSON

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.

CPENameOperatorVersion
restkiteq2.1.1
restkiteq1.0.0
restkiteq2.1.3
restkiteq2.3.1
restkiteq2.0.2
restkiteq2.0.5
restkiteq1.1.0
restkiteq2.2.1
restkiteq3.0.0
restkiteq1.1.1