PT-2012-4719 · Apache · Apache Libcloud

Martin Georgiev + 2 · Published 2012-11-04 · Updated 2024-02-14 · CVE-2012-3446

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Libcloud versions prior to 0.11.1

Description The issue arises from an incorrect regular expression used during the verification process of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

Recommendations For versions prior to 0.11.1, update to version 0.11.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL connections to trusted servers until the update is applied.

Exploit

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

CWE-185

Related Identifiers

CVE-2012-3446

GHSA-PRCQ-52F8-FP44

PYSEC-2012-12

Affected Products

Apache Libcloud

References · 11

• 🔥 http://cs.utexas.edu/~shmat/shmat_ccs12.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3446 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3446 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3446 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3446 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-12 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prcq-52f8-fp44 · Vendor Advisory
• https://github.com/apache/libcloud · Note
• https://github.com/apache/libcloud/commit/f2af5502dae3ac63e656dd1b7d5f29cc82ded401 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2012-12.yaml · Note
• https://svn.apache.org/repos/asf/libcloud/trunk/CHANGES · Note