Cleartext Transmission of Sensitive Information in the nntplib Module

The Python module nntplib provides a number of functions for accessing NNTP servers. However, the default behavior of the module does not provide utilize secure connections. This means that data transmitted over the network, including passwords, is sent in cleartext. This makes it possible for attackers to intercept and read this data.

The Python module nntplib should only in a secure mannner to protect sensitive data when accessing NNTP servers.

Example

from nntplib import NNTP


with NNTP('news.gmane.io') as n:
    n.group('gmane.comp.python.committers')

Remediation

If the NNTP protocol must be used and sensitive data will be transferred, it is recommended to secure the connection using NNTP_SSL class. Alternatively, the starttls function can be used to enter a secure session.

from nntplib import NNTP


with NNTP_SSL('news.gmane.io') as n:
    n.group('gmane.comp.python.committers')

See also

• nntplib — NNTP protocol client
• CWE-319: Cleartext Transmission of Sensitive Information

New in version 0.1.9