CVE-2014-0161 ovirt-engine-sdk-python improper validation of hostname in x.509 certificate
MediumCVSS 5.9
EPSS 0.41%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ovirt-engine-sdk-python(PyPI) | < 3.4.0.7 | 3.4.0.7 |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.3.0.3-1 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.3.0.6-1 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.3.0.7-1 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.3.0.8-1 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.3.5.0 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.4.0.1-1 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.4.0.2 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | = 3.4.0.6 | No fix listed |
| pypi ovirt-engine-sdk-python(PyPI) | >= 3.5.0.0, < 3.5.0.4 | 3.5.0.4 |
| ovirt-engine-sdk-python project ovirt-engine-sdk-python | < 3.4.0.7 | 3.4.0.7 |
| ovirt-engine-sdk-python project ovirt-engine-sdk-python | >= 3.5.0.0, < 3.5.0.4 | 3.5.0.4 |
| ovirt-engine-sdk-python | = before 3.4.0.7 and 3.5.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com broken-link
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com product
- github.com
- github.com vendor-advisory