CVE-2020-27589
Improper Certificate Validation in blackduck
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
CVE-2020-27589- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
CVE-2020-27589- Updated
- 2026-11-02
EUVDEUVD-2020-0052 No score
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
EUVD-2020-0052- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f248-v4qh-x2r6
Improper Certificate Validation in blackduck
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
GHSA-f248-v4qh-x2r6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
CVE-2020-27589- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-f248-v4qh-x2r6
Improper Certificate Validation in blackduck
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
GHSA-f248-v4qh-x2r6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVPYSEC-2020-26 No score
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Record
PYSEC-2020-26- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
blackduckPyPI |
0.0.25 up to 0.0.53 | 0.0.53 |
blackduckPyPI |
0.0.25 up to 0.0.53, plus listed versions 0.0.260.0.270.0.280.0.290.0.30 Show 22 moreShow less0.0.310.0.320.0.330.0.340.0.350.0.360.0.370.0.380.0.390.0.400.0.410.0.420.0.430.0.440.0.450.0.460.0.470.0.480.0.490.0.500.0.510.0.52 |
0.0.53 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27589 is a high vulnerability (CVSS 7.5) in Synopsys Hub-rest-api-python, published November 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in blackduck 0.0.53.
References
pypi.org/project/blackduck
github.com/blackducksoftware/hub-rest-api-python
optiv.com/explore-optiv-insights/source-zero/certificate-validation-disabled-black-duck-api-wrapper
community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified
nvd.nist.gov/vuln/detail/CVE-2020-27589