CVE-2012-3533

Published: Aug 31, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.

Affected (3)

Products: Ovirt: Ovirt, Ovirt Engine Cli · Ovirt Engine Sdk: 3.1.0.5

2 products

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ovirt Ovirt	Version 3.1
Ovirt Ovirt Engine Cli	Up to 3.1.0.5
Ovirt Engine Sdk 3.1.0.5	All versions

Related CWEs

CWE-310

References (16)

http://gerrit.ovirt.org/#/c/7209/

Source: secalert@redhat.com

http://gerrit.ovirt.org/#/c/7249/

Source: secalert@redhat.com

http://secunia.com/advisories/50409

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/08/24/6

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/08/26/1

Source: secalert@redhat.com

http://www.securityfocus.com/bid/55208

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=851672

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/77984

Source: secalert@redhat.com

http://gerrit.ovirt.org/#/c/7209/