CVE catalog

CVE-2012-5825

Severity: High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Nov 4, 2012, 10:55:00 PM UTC
Updated: Sep 17, 2026, 2:22:42 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.61% · Oct 25, 2026

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	tweepy	bookworm	`4.12.1-3`	fixed
Cpe	tweepy	Not reported	`3.0.0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	tweepy	source	bookworm	`3.1.0-2`	low	Not reported	[692444]
Cpe	tweepy	cpe	Not reported	`3.0.0`	Not reported	NVD-CVE-2012-5825	Not reported

[Debian bug #692444]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-tweepy]Fixed
Source package: [tweepy]
Details (2)
- 4.12.1-3 · all · bookworm
  Fixed · Fixed: 3.1.0-2
  nvd · tweepy · debian · bookworm; nvd · tweepy · debian · 12
- 4.12.1-3 · all · bookworm
  Fixed · Fixed: 3.1.0-2
  nvd · tweepy · debian · bookworm; nvd · tweepy · debian · 12
[python-tweepy-doc]Fixed
Source package: [tweepy]
Details (2)
- 4.12.1-3 · all · bookworm
  Fixed · Fixed: 3.1.0-2
  nvd · tweepy · debian · bookworm; nvd · tweepy · debian · 12
- 4.12.1-3 · all · bookworm
  Fixed · Fixed: 3.1.0-2
  nvd · tweepy · debian · bookworm; nvd · tweepy · debian · 12

Observed: Oct 23, 2026, 5:06:48 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]