PT-2018-7154 · Red Hat · Red Hat Virtualization+2

Published 2018-07-27 · Updated 2023-02-12 · CVE-2017-2639

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CloudForms (affected versions not specified)

Description: The issue arises from CloudForms not verifying that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This could allow an attacker to spoof RHEV or OpenShift systems, potentially leading to the harvesting of sensitive information from CloudForms.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-2639

RHSA-2017:1367

Affected Products

Cloudforms

Openshift

Red Hat Virtualization

References · 6

• https://access.redhat.com/errata/RHSA-2017:1367 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2639 · Security Note
• http://securitytracker.com/id/1038599 · Note
• http://securityfocus.com/bid/98769 · Note