Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-W64C-PXJJ-H866
HistoryOct 10, 2018 - 5:23 p.m.

Ansible does not verify that the server hostname matches a domain name in certificates

2018-10-1017:23:51
Google
osv.dev
5

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.4%

JSON

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CPENameOperatorVersion
ansibleeq1.6
ansibleeq1.5.1
ansibleeq1.8.4
ansibleeq1.3.4
ansibleeq1.7.1
ansibleeq1.3.1
ansibleeq1.2
ansibleeq1.1
ansibleeq1.6.10
ansibleeq1.6.9
Rows per page:
1-10 of 451

Related

fedora 2
nessus 6
osv 2
openvas 4
mageia 1
github 1
veracode 1
debiancve 1
ubuntucve 1
cve 1
prion 1
cvelist 1
freebsd 1
debian 1
fedora
fedora
[SECURITY] Fedora 22 Update: ansible-1.9.2-1.fc22
2015-07-05 18:56:03
[SECURITY] Fedora 21 Update: ansible-1.9.2-1.fc21
2015-07-05 18:56:55
nessus
nessus
openSUSE Security Update : ansible (openSUSE-2015-557)
2015-08-31 00:00:00
Fedora 22 : ansible-1.9.2-1.fc22 (2015-10797)
2015-07-06 00:00:00
Fedora 21 : ansible-1.9.2-1.fc21 (2015-10807)
2015-07-06 00:00:00
osv
osv
PYSEC-2015-1
2015-08-12 14:59:00
ansible - security update
2019-09-16 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2015-0292)
2015-10-15 00:00:00
Fedora Update for ansible FEDORA-2015-10807
2015-10-30 00:00:00
Fedora Update for ansible FEDORA-2015-10797
2015-07-07 00:00:00
mageia
mageia
Updated ansible package fixes security vulnerability
2015-07-29 00:01:59
github
github
Ansible does not verify that the server hostname matches a domain name in certificates
2018-10-10 17:23:51
veracode
veracode
Man-in-the-Middle (MitM)
2017-04-05 02:01:13
debiancve
debiancve
CVE-2015-3908
2015-08-12 14:59:00
ubuntucve
ubuntucve
CVE-2015-3908
2015-08-12 00:00:00
cve
cve
CVE-2015-3908
2015-08-12 14:59:00
prion
prion
Code injection
2015-08-12 14:59:00
cvelist
cvelist
CVE-2015-3908
2015-08-12 14:00:00
freebsd
freebsd
ansible -- multiple vulnerabilities
2015-06-25 00:00:00
debian
debian
[SECURITY] [DLA 1923-1] ansible security update
2019-09-16 12:23:45

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

47.4%

JSON
Related for OSV:GHSA-W64C-PXJJ-H866
fedora2nessus6osv2openvas4mageia1github1veracode1debiancve1ubuntucve1cve1prion1cvelist1freebsd1debian1