CVE-2012-5825

No known exploitation. EPSS puts it in the 49th percentile. Fixed versions are out.

CVSS 3.17.4High EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products2 fixed builds listed below

Published 2012-11-04Updated 2026-09-17Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

PyPI tweepyAffected: < 3.0Upgrade to: 3.0Stated by: GitHub advisory
TweepyAffected: < 3.0.0Upgrade to: 3.0.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your application uses Tweepy and identify its installed version.
Upgrade Tweepy to version 3.0 or later.
If upgrading is delayed, avoid running affected applications on untrusted networks and use a trusted encrypted network connection.

pip install 'tweepy>=3.0'

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.

In plain language

Written by AI from the record

Tweepy versions before 3.0 can be fooled into connecting to an impostor server, so businesses using them should upgrade to 3.0 or later.

Tweepy before 3.0 fails to validate that an SSL/TLS certificate hostname matches the intended server, enabling man-in-the-middle server spoofing with an otherwise valid certificate.

If you're affected

Account credential theft
Twitter account takeover
Sensitive message exposure
Altered social-media actions

What is it

Tweepy is software that lets an application communicate with Twitter. In affected versions, it may accept a convincing-looking but wrong server identity—like handing sensitive paperwork to someone wearing a realistic delivery uniform instead of the real courier.

Who is affected

This matters to you if your business runs an application that uses Tweepy. It is relevant when that application connects to Twitter or another service through Tweepy over a network an attacker can intercept.

How urgent is it

An attacker would need to intercept the application’s network connection and present a valid certificate for a different server. There is no record of active exploitation or public exploit code, so this is an amber-priority upgrade rather than an emergency response.

What to do — in detail

Confirm exposure by checking application dependency files and the installed package version, for example with pip show tweepy in the application environment. Upgrade to Tweepy 3.0 or later; the vendor remediation identifies PyPI/tweepy >= 3.0 as fixed. Test the application after upgrading because an older dependency set may require compatibility checks. If patching must wait, restrict the application to trusted networks or a trusted encrypted tunnel so an attacker cannot intercept its outbound connection. There is no CISA KEV due date because this CVE is not listed in KEV. Monitor application connection failures and unexpected certificate-related errors during and after the upgrade.

Technical context

CVSS 3.1 is 7.4 (High): AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The issue is hostname-validation failure in certificate handling, described under CWE-20; an on-path attacker can spoof the intended SSL server using an arbitrary valid certificate whose CN or subjectAltName does not match the target hostname. CISA KEV does not list this CVE, no public exploit code is on record, and EPSS is 0.6% (48th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 5065 days, from the signal feeds we watch.

2026-09-17Patch availablerecord updated
2026-04-29Patch availablerecord updated
2012-11-04Publishedweakness classified, att&ck mapped

Affected products

tweepypackage-ecosystem
- tweepyLibraryOSS Libraries / pypi
PyPIpackage-ecosystem
- tweepyOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Scored 7.4 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact