CVE-2013-2191
python-bugzilla has improper validation of X.509 certificates
CVE-2013-2191 is a medium vulnerability (CVSS 4.3) in Python Bugzilla Project Python-bugzilla, published February 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in python-bugzilla 0.9.0.
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
Exploit likelihood
What each source reports
NVD Score used
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- Record
CVE-2013-2191- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- Record
CVE-2013-2191- Updated
- 2026-11-02
EUVDEUVD-2014-0086 No score
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- Record
EUVD-2014-0086- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2q4h-27m7-rj67
python-bugzilla has improper validation of X.509 certificates
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- Record
GHSA-2q4h-27m7-rj67- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-2q4h-27m7-rj67
python-bugzilla has improper validation of X.509 certificates
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- Record
GHSA-2q4h-27m7-rj67- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10058-1 No score
python-bugzilla-1.2.2-1.1 on GA media
These are all security issues fixed in the python-bugzilla-1.2.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10058-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:11221-1 No score
python36-bugzilla-3.0.2-1.6 on GA media
These are all security issues fixed in the python36-bugzilla-3.0.2-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11221-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14135-1 No score
python310-bugzilla-3.2.0-2.3 on GA media
These are all security issues fixed in the python310-bugzilla-3.2.0-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14135-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12002-1 No score
python313-bugzilla-3.3.0-1.4 on GA media
These are all security issues fixed in the python313-bugzilla-3.3.0-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12002-1- Updated
- 2026-11-02
OSVPYSEC-2014-88 No score
python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
- Record
PYSEC-2014-88- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-bugzillaPyPI |
before 0.9.0 | 0.9.0 |
python-bugzillaPyPI |
before 0.9.0, plus listed versions 0.6.20.7.00.8.0 |
0.9.0 |
python-bugzillaopenSUSE:Tumbleweed |
before 1.2.2-1.1 | 1.2.2-1.1 |
python-bugzillaopenSUSE:Tumbleweed |
before 3.2.0-2.3 | 3.2.0-2.3 |
python-bugzillaopenSUSE:Tumbleweed |
before 3.3.0-1.4 | 3.3.0-1.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2013/06/19/6
lists.opensuse.org/opensuse-updates/2013-07/msg00026.html
git.fedorahosted.org/cgit/python-bugzilla.git/commit?id=a782282ee479ba4cc1b8b1d89700ac630ba83eef
bugzilla.redhat.com/show_bug.cgi?id=951594
lists.fedorahosted.org/pipermail/python-bugzilla/2013-June/000104.html
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-2191
github.com/python-bugzilla/python-bugzilla/commit/a782282ee479ba4cc1b8b1d89700ac630ba83eef
suse.com/security/cve/CVE-2013-2191