PYSEC-2020-245

2020-01-0218:15:00

Google

osv.dev

0.001 Low

EPSS

Percentile

28.8%

JSON

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

CPENameOperatorVersion
ovirt-engine-sdk-pythoneq3.4.0.6
ovirt-engine-sdk-pythoneq3.3.0.7-1
ovirt-engine-sdk-pythoneq3.3.0.3-1
ovirt-engine-sdk-pythoneq3.3.5.0
ovirt-engine-sdk-pythoneq3.4.0.1-1
ovirt-engine-sdk-pythoneq3.4.0.2
ovirt-engine-sdk-pythoneq3.3.0.8-1
ovirt-engine-sdk-pythoneq3.3.0.6-1

Name	Operator	Version
ovirt-engine-sdk-python	eq	3.4.0.6
ovirt-engine-sdk-python	eq	3.3.0.7-1
ovirt-engine-sdk-python	eq	3.3.0.3-1
ovirt-engine-sdk-python	eq	3.3.5.0
ovirt-engine-sdk-python	eq	3.4.0.1-1
ovirt-engine-sdk-python	eq	3.4.0.2
ovirt-engine-sdk-python	eq	3.3.0.8-1
ovirt-engine-sdk-python	eq	3.3.0.6-1