CVE-2014-0161

Published: Jan 2, 2020Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

Affected (2)

Products: Ovirt Engine Sdk Python Project: Ovirt Engine Sdk Python

Ovirt Engine Sdk Python Project

1 product

Ovirt Engine Sdk Python

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ovirt Engine Sdk Python Project Ovirt Engine Sdk Python	Before 3.4.0.7
Ovirt Engine Sdk Python Project Ovirt Engine Sdk Python	From 3.5.0.0 to 3.5.0.4

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (4)

https://access.redhat.com/security/cve/cve-2014-0161

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://access.redhat.com/security/cve/cve-2014-0161

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.