Insecure Certificate Validation

2021-04-2023:44:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

58.6%

JSON

blackduck is using insecure certificate validation. The vulnerability exists because It does not enforce SSL certificate validation could if the calling code uses either the upload_scan or download_project_scans methods.

CPENameOperatorVersion
blackduckle0.0.52
blackduckle0.0.52

CPE	Name	Operator	Version
	blackduck	le	0.0.52
	blackduck	le	0.0.52

References

community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified

github.com/blackducksoftware/hub-rest-api-python

github.com/blackducksoftware/hub-rest-api-python/commit/273b27d0de1004389dd8cf43c40b1197c787e7cd

github.com/blackducksoftware/hub-rest-api-python/pull/113/commits/273b27d0de1004389dd8cf43c40b1197c787e7cd

pypi.org/project/blackduck/

www.optiv.com/explore-optiv-insights/source-zero/certificate-validation-disabled-black-duck-api-wrapper

0.002 Low

EPSS

Percentile

58.6%

JSON

Related for VERACODE:30057