CVE-2023-37920

Advisory

Unicorn-binance-rest-api version 2.4.0 has increased the minimum required version of `certifi` to `2023.7.22` due to vulnerabilities found in earlier versions, notably CVE-2023-37920.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Exclude known security vulnerabilities in dependencies by increasing the minimum version numbers of the dependencies.
Changed
- Updated description text in all files.
- Update of `get_used_weight()`, removed parameter `make_new_request`, it is now allways using `ping()` to get the
current used weight.
- https://pypi.org/project/requesocks/ has been discontinued and socks support is now provided directly by `requests`.
Fixed
- Import in `licensing_manager.py`.
- Type of global `logger` variable.
Security
- Set higher minimum version `2023.7.22` for `certifi`, as vulnerabilities were found in earlier versions:
- CVE-2023-37920, Score: 9.8 (High)
- Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while
verifying the identity of TLS hosts. Certifi 1.0.1 through 2023.5.7 recognizes "e-Tugra" root certificates.
e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their
systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
- https://devhub.checkmarx.com/cve-details/CVE-2023-37920/
- Set higher minimum version `42.0.4` for `cryptography`, as vulnerabilities were found in earlier versions:
- CVE-2023-38325, Score: 7.5 (High)
- The cryptography package versions prior to 41.0.2 for Python mishandles SSH certificates that have critical
options.
- https://devhub.checkmarx.com/cve-details/CVE-2023-38325/
- CVE-2023-49083, Score: 7.5 (High)
- Cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling
`load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and
segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application
attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system
availability and stability. This issue affects versions 3.1 through 41.0.5.
- https://devhub.checkmarx.com/cve-details/CVE-2023-49083/
- CVE-2023-50782, Score: 7.5 (High)
- A flaw was found in the python cryptography package versions prior to 42.0.0. This issue may allow a remote
attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of
confidential or sensitive data. This issue is an incomplete fix of CVE-2020-25659.
- https://devhub.checkmarx.com/cve-details/CVE-2023-50782/
- CVE-2024-26130, Score: 7.5 (High)
- cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting
in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a
certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash`
set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur,
crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError`
is properly raised.
- https://devhub.checkmarx.com/cve-details/CVE-2024-26130/
- Set higher minimum version `2.31.0` for `requests`, as vulnerabilities were found in earlier versions:
- CVE-2023-32681, Score: 6.1 (Medium)
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
versions 2.3.0 through 2.30.0.
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37920