Man-in-the-Middle (MitM) Affecting setuptools package, versions [,1.3)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SETUPTOOLS-40728
- published 4 Dec 2017
- disclosed 28 Oct 2013
- credit Unknown
How to fix?
Upgrade setuptools to version 1.3 or higher.
Overview
Affected versions of setuptools are vulnerable to Man-in-the-Middle (MitM) attack.
The ssl.match_hostname function does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate. (same as CVE-2013-7440).
References
CVSS Scores
version 3.1