Improper Certificate Validation Affecting bigflow package, versions [,1.6.0)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
0.13% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-BIGFLOW-5417252
  • published11 Apr 2023
  • disclosed11 Apr 2023
  • creditKonstantin Weddige

Introduced: 11 Apr 2023

CVE-2023-25392  (opens in a new tab)
CWE-295  (opens in a new tab)

How to fix?

Upgrade bigflow to version 1.6.0 or higher.

Overview

bigflow is a BigQuery client wrapper with clean API

Affected versions of this package are vulnerable to Improper Certificate Validation such that the get_vault_token function is sending the X-Vault-Token header with the vault secret to the vault endpoint without verifying the server certificate. This allows any Man in the Middle attacker to read the vault secret and gain access to the vault.

CVSS Base Scores

version 3.1