Lucene search

[email protected]CVE-2012-3533

HistoryAug 31, 2012 - 8:55 p.m.

CVE-2012-3533

2012-08-3120:55:00

CWE-310

[email protected]

web.nvd.nist.gov

cve-2012-3533

python sdk

cli

ovirt 3.1

ssl certificate

mitm attack

7.4 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.8%

JSON

The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.

CPENameOperatorVersion
ovirt:ovirt-engine-cliovirt ovirt-engine-clile3.1.0.5
ovirt-engine-sdk:3.1.0.5ovirt-engine-sdk 3.1.0.5eq*
ovirt:ovirtovirteq3.1

CPE	Name	Operator	Version
ovirt:ovirt-engine-cli	ovirt ovirt-engine-cli	le	3.1.0.5
ovirt-engine-sdk:3.1.0.5	ovirt-engine-sdk 3.1.0.5	eq	*
ovirt:ovirt	ovirt	eq	3.1

References

gerrit.ovirt.org/#/c/7209/

gerrit.ovirt.org/#/c/7249/

secunia.com/advisories/50409

www.openwall.com/lists/oss-security/2012/08/24/6

www.openwall.com/lists/oss-security/2012/08/26/1

www.securityfocus.com/bid/55208

bugzilla.redhat.com/show_bug.cgi?id=851672

exchange.xforce.ibmcloud.com/vulnerabilities/77984

7.4 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.8%

JSON

Related for CVE-2012-3533

cvelist1 prion1