CVE-2012-5822

Zamboni's contribution feature lacks certificate hostname verification, enabling SSL spoofing

• CVSS 7.4
• CWE-295
• Cryptographic
• Remote

The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python urllib2 library.

CVE

CVE-2012-5822

CWE

CWE-295

CVSS base score

7.4

Published

2012-11-04

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Zamboni to verify the server hostname in the X.509 certificate.

import urllib2

url = 'https://example.com'
request = urllib2.Request(url)

try:
    response = urllib2.urlopen(request)
    content = response.read()
    print(content)
except urllib2.URLError as e:
    print(f"Failed to open URL: {e}")

import ssl
import urllib2

context = ssl.create_default_context()
context.check_hostname = True
context.verify_mode = ssl.CERT_REQUIRED

url = 'https://example.com'
request = urllib2.Request(url)

try:
    response = urllib2.urlopen(request, context=context)
    content = response.read()
    print(content)
except urllib2.URLError as e:
    print(f"Failed to open URL: {e}")

@misc{vaitp:cve20125822,
  title        = {{Zamboni's contribution feature lacks certificate hostname verification, enabling SSL spoofing}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2012},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2012-5822},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2012-5822/}}
}