PT-2012-4719 · Apache · Apache Libcloud

Martin Georgiev + 2 · Publicado 2012-11-04 · Atualizado 2024-02-14 · CVE-2012-3446

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Libcloud versions prior to 0.11.1

Description The issue arises from an incorrect regular expression used during the verification process of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

Recommendations For versions prior to 0.11.1, update to version 0.11.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL connections to trusted servers until the update is applied.

Exploit

Correção

RCE

Improper Certificate Validation

Enumeração de Fraquezas

CWE-20

CWE-295

CWE-185

Identificadores relacionados

CVE-2012-3446

GHSA-PRCQ-52F8-FP44

PYSEC-2012-12

Produtos afetados

Apache Libcloud

Referências · 11

• 🔥 http://cs.utexas.edu/~shmat/shmat_ccs12.pdf · Exploit
• https://github.com/apache/libcloud · Nota
• https://github.com/apache/libcloud/commit/f2af5502dae3ac63e656dd1b7d5f29cc82ded401 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2012-12.yaml · Nota
• https://svn.apache.org/repos/asf/libcloud/trunk/CHANGES · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3446 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3446 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-3446 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-3446 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2012-12 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-prcq-52f8-fp44 · Aviso do Fabricante