CVE-2025-25305

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-25305", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-02-06T17:13:33.124Z", "datePublished": "2025-02-18T18:53:10.870Z", "dateUpdated": "2025-02-18T19:23:41.622Z"}, "containers": {"cna": {"title": "SSL validation for outgoing requests in Home Assistant Core and used libs not correct", "problemTypes": [{"descriptions": [{"cweId": "CWE-940", "lang": "en", "description": "CWE-940: Improper Verification of Source of a Communication Channel", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6"}], "affected": [{"vendor": "home-assistant", "product": "core", "versions": [{"version": "< 2024.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-02-18T18:53:10.870Z"}, "descriptions": [{"lang": "en", "value": "Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-m3pm-rpgg-5wj6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-18T19:23:18.464411Z", "id": "CVE-2025-25305", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T19:23:41.622Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-25305", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-18T19:23:18.464411Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T19:23:24.869Z"}}], "cna": {"title": "SSL validation for outgoing requests in Home Assistant Core and used libs not correct", "source": {"advisory": "GHSA-m3pm-rpgg-5wj6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "home-assistant", "product": "core", "versions": [{"status": "affected", "version": "< 2024.1.6"}]}], "references": [{"url": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6", "name": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-940", "description": "CWE-940: Improper Verification of Source of a Communication Channel"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-02-18T18:53:10.870Z"}}}, "cveMetadata": {"cveId": "CVE-2025-25305", "state": "PUBLISHED", "dateUpdated": "2025-02-18T19:23:41.622Z", "dateReserved": "2025-02-06T17:13:33.124Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-02-18T18:53:10.870Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "core", "vendor": "home-assistant", "versions": [{"status": "affected", "version": "< 2024.1.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Home Assistant Core es una automatizaci\u00f3n de origen de c\u00f3digo abierto que pone primero el control local y la privacidad. Las versiones afectadas est\u00e1n sujetas a los posibles ataques de hombre en el medio debido a la verificaci\u00f3n de certificado SSL faltante en la base de c\u00f3digo del proyecto y usaron de terceros librer\u00edas. En el pasado, `aiohttp-session`/` request 'ten\u00eda el par\u00e1metro `verify_ssl` para controlar la verificaci\u00f3n del certificado SSL. Este era un valor booleano. En `aiohttp` 3.0, este par\u00e1metro estaba desapercibido a favor del par\u00e1metro` SSL`. Solo cuando `SSL` se establece en` None` o se proporciona con un contexto SSL configurado correcto, la verificaci\u00f3n de certificado SSL est\u00e1ndar ocurrir\u00e1. Al migrar las integraciones en el Asistente de inicio librer\u00edas Aries utilizados por el Asistente de inicio, en algunos casos el valor del par\u00e1metro `Verify_SSL` se movi\u00f3 al nuevo par\u00e1metro` SSL`. Esto dio como resultado estas integraciones y librer\u00edas usando `request.ssl ??= true`, que desactiv\u00f3 involuntariamente la verificaci\u00f3n del certificado SSL y abri\u00f3 un vector de ataque de hombre en el medio. Este problema se ha abordado en la versi\u00f3n 2024.1.6 y se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "id": "CVE-2025-25305", "lastModified": "2026-06-17T09:00:39.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-25305", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-18T19:23:18.464411Z", "version": "2.0.3"}}]}, "published": "2025-02-18T19:15:29.083", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-940"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}