-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the urlopen function in pym/portage/util/_urlopen.py as the source of the flaw. Multiple sources (CVE, GHSA, Gentoo bug reports) confirm this function bypassed SSL certificate validation when handling HTTPS requests. The bug report analysis shows the original code used urllib_request.build_opener() without certificate checks, and the fix involved switching to FETCHCOMMAND (wget) for secure fetching. No other functions are mentioned as vulnerable in the provided context.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| portage | pip | < 2.1.12.2 | 2.1.12.2 |