python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.
CVSS 2.0MEDIUM 4.3·Network·No auth·Interaction —·EPSS 0.00892·Published 2014-02-08·Fixed in 0.9.0CWE-20