PT-2011-1509 · Apache · Libcloud
Dave B
·
Publicado
2011-09-11
·
Atualizado
2022-05-17
·
CVE-2010-4340
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
libcloud versions prior to 0.4.1
Description
The issue allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack because libcloud does not verify SSL certificates for HTTPS connections. This is partly due to an upstream issue with python's SSL module.
Recommendations
For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider disabling HTTPS connections until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation. Avoid using libcloud for critical operations that require secure connections until the issue is resolved.
Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Libcloud