The electrum bitcoin wallet seems to use SSL insecurely. Here are two bug reports I filed about it:

ignores invalid ssl certs with CERT_NONE, allowing MITM

fails to verify ssl cert hostname for cached certs
(update: Seems I was wrong about this bug)

One full month after I filed these, there's been no activity, so I thought I'd make this a little more widely known. It's too hard to get CVEs assigned, and resgistering a snarky domain name is passe.

I'm not actually using electrum myself currently, as I own no bitcoins. I only noticed these vulnerabilities when idly perusing the code. I have not tried to actually exploit them, and some of the higher levels of the SPV blockchain verification make them difficult to exploit. Or perhaps there are open wifi networks where all electrum connections get intercepted by a rogue server that successfully uses these security holes to pretend to be the entire electrum server network.

I'm not particularly surprised to find code that's supposed to be securing a connection with SSL but actually fails to verify the SSL certificate. That's the common failure mode of SSL libraries.

It is a bit surprising to find such mistakes in a bitcoin wallet though. And, electrum seems to go out of its way to complicate its SSL certificate handling, which directly led to these security holes. Kind of makes me wonder about the security of the rest of it.