PT-2011-1509 · Apache · Libcloud

Dave B · Published 2011-09-11 · Updated 2022-05-17 · CVE-2010-4340

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libcloud versions prior to 0.4.1

Description The issue allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack because libcloud does not verify SSL certificates for HTTPS connections. This is partly due to an upstream issue with python's SSL module.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider disabling HTTPS connections until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation. Avoid using libcloud for critical operations that require secure connections until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-264

Related Identifiers

CVE-2010-4340

GHSA-W3J6-8J34-Q43X

PYSEC-2011-24

Affected Products

Libcloud

References · 16

• https://osv.dev/vulnerability/CVE-2010-4340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4340 · Security Note
• https://osv.dev/vulnerability/PYSEC-2011-24 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-4340 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4340 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w3j6-8j34-q43x · Vendor Advisory
• https://github.com/apache/libcloud · Note
• https://github.com/apache/libcloud/commit/87ee61e6ba03a43dcefea2ce180988bec066b6fd · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2011-24.yaml · Note
• http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira%40thor%3E · Note
• http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201011.mbox/browser · Note
• https://issues.apache.org/jira/browse/LIBCLOUD-55 · Note
• http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira@thor%3E · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463 · Note
• http://wiki.apache.org/incubator/LibcloudSSL · Note