GitHub Advisory DatabaseGHSA-QGFG-GVFF-523Vpython-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
55.0%
The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| CPE | Name | Operator | Version |
|---|---|---|---|
| python-glanceclient | lt | 0.10.0 |
References
lists.opensuse.org/opensuse-updates/2013-08/msg00019.html
rhn.redhat.com/errata/RHSA-2013-1200.html
www.ubuntu.com/usn/USN-2004-1
access.redhat.com/errata/RHSA-2013:1200
access.redhat.com/security/cve/CVE-2013-4111
bugs.launchpad.net/ossa/+bug/1192229
bugzilla.redhat.com/show_bug.cgi?id=989738
github.com/advisories/GHSA-qgfg-gvff-523v
github.com/openstack/python-glanceclient/blob/master/doc/source/index.rst
nvd.nist.gov/vuln/detail/CVE-2013-4111
Related
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
55.0%