Openalgo
Monthly
OpenAlgo 1.0.0.29 up to but excluding 2.0.3.1 ships SMTP client code that switches off TLS certificate and hostname verification, so a network-positioned attacker who can intercept the path between OpenAlgo and its configured mail server can present a forged certificate, terminate the TLS session, and read the SMTP username and password along with every subsequent message - including password-reset links. The weakness is in the shipped code itself (utils/email_utils.py and utils/email_debug.py) and applies to both STARTTLS and implicit SMTPS paths, so any affected instance that sends mail is exposed without special configuration. Exploitation still requires the attacker to hold an active man-in-the-middle position (AV:A, AC:H, AT:P), which is the main limiter; no public exploit has been identified at time of analysis and no active exploitation is confirmed, making this a medium-severity confidentiality issue suited to scheduled, this-month remediation rather than emergency response.
OpenAlgo 1.0.0.29 up to but excluding 2.0.3.1 ships SMTP client code that switches off TLS certificate and hostname verification, so a network-positioned attacker who can intercept the path between OpenAlgo and its configured mail server can present a forged certificate, terminate the TLS session, and read the SMTP username and password along with every subsequent message - including password-reset links. The weakness is in the shipped code itself (utils/email_utils.py and utils/email_debug.py) and applies to both STARTTLS and implicit SMTPS paths, so any affected instance that sends mail is exposed without special configuration. Exploitation still requires the attacker to hold an active man-in-the-middle position (AV:A, AC:H, AT:P), which is the main limiter; no public exploit has been identified at time of analysis and no active exploitation is confirmed, making this a medium-severity confidentiality issue suited to scheduled, this-month remediation rather than emergency response.