{"id":"CVE-2020-27589","aliases":["EUVD-2020-0052","GHSA-f248-v4qh-x2r6","PYSEC-2020-26"],"status":"published","title":"Improper Certificate Validation in blackduck","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01126,"percentile":0.66755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2020-11-06T13:15:13Z","modified":"2026-10-20T10:52:59Z","fixes":[{"ecosystem":"PyPI","package":"blackduck","fixed_in":["0.0.53"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"blackduck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.25"},{"fixed":"0.0.53"}]}]},{"source":"osv","ecosystem":"PyPI","package":"blackduck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.25"},{"fixed":"0.0.53"}]}],"versions":["0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.39","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.50","0.0.51","0.0.52"]},{"source":"osv","ecosystem":"PyPI","package":"blackduck","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.25"},{"fixed":"0.0.53"}]}],"versions":["0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.39","0.0.40","0.0.41","0.0.42","0.0.43","0.0.44","0.0.45","0.0.46","0.0.47","0.0.48","0.0.49","0.0.50","0.0.51","0.0.52"]}],"products":[{"vendor":"synopsys","product":"hub-rest-api-python"}],"references":[{"url":"https://pypi.org/project/blackduck/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","package"]},{"url":"https://github.com/blackducksoftware/hub-rest-api-python","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","package","web"]},{"url":"https://github.com/blackducksoftware/hub-rest-api-python/pull/113/commits/273b27d0de1004389dd8cf43c40b1197c787e7cd","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.optiv.com/explore-optiv-insights/source-zero/certificate-validation-disabled-black-duck-api-wrapper","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27589","tags":["advisory"]},{"url":"https://github.com/blackducksoftware/hub-rest-api-python/pull/113","tags":["web"]},{"url":"https://github.com/blackducksoftware/hub-rest-api-python/commit/0a25777117515b8b4ff287a98f57837a8c6bdbdb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f248-v4qh-x2r6","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/blackduck/PYSEC-2020-26.yaml","tags":["web"]},{"url":"https://pypi.org/project/blackduck","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-27589","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2020-11-06T13:15:13Z","modified":"2024-08-04T16:18:44.415Z","updated_at":"2026-11-02T14:35:53.552996Z"}],"euvd":[{"id":"EUVD-2020-0052","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2020-11-06T13:15:13Z","modified":"2024-08-04T16:18:44Z","updated_at":"2026-11-03T03:07:12.940476Z"}],"ghsa":[{"id":"GHSA-f248-v4qh-x2r6","title":"Improper Certificate Validation in blackduck","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2021-04-20T16:29:41Z","modified":"2024-09-13T17:43:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2020-27589","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2020-11-06T14:15:16.457Z","modified":"2026-06-17T03:09:19.817Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-27589","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2020-11-06T14:15:16.457Z","modified":"2026-10-20T10:52:59.785739838Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"GHSA-f248-v4qh-x2r6","title":"Improper Certificate Validation in blackduck","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2021-04-20T16:29:41Z","modified":"2024-09-13T18:02:52.911555Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"PYSEC-2020-26","description":"Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.","status":"published","published":"2020-11-06T14:15:00Z","modified":"2023-11-08T04:03:21.744685Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}