apache libcloud vulnerabilities

Latest apache libcloud CVEs

Newest publication first

1. CVE-2013-6480 Libcloud does not properly scrub data when destroying a DigitalOcean node

   Published 2014-01-07

   Low·CVSS 2.1 EPSS 2.1%

   Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

2. CVE-2012-3446 Apache Libcloud vulnerable to certificate impersonation

   Published 2012-11-04

   Medium·CVSS 5.9

   Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL se...

3. CVE-2010-4340 Apache Libcloud does not verify SSL certificates for HTTPS connections

   Published 2011-09-12

   Medium·CVSS 4.3

   libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.