PT-2020-7591 · Ovirt · Ovirt-Engine-Sdk-Python

Published 2020-01-02 · Updated 2022-05-17 · CVE-2014-0161

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ovirt-engine-sdk-python versions prior to 3.4.0.7 ovirt-engine-sdk-python versions prior to 3.5.0.4

Description The issue arises from the failure to verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

Recommendations For versions prior to 3.4.0.7, update to version 3.4.0.7 or later. For versions prior to 3.5.0.4, update to version 3.5.0.4 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2014-0161

GHSA-WF9J-M9FV-92GQ

PYSEC-2020-245

Affected Products

Ovirt-Engine-Sdk-Python

References · 8

• https://osv.dev/vulnerability/PYSEC-2020-245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0161 · Security Note
• https://osv.dev/vulnerability/GHSA-wf9j-m9fv-92gq · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/ovirt-engine-sdk-python/PYSEC-2020-245.yaml · Note
• https://github.com/oVirt/python-ovirt-engine-sdk4 · Note
• https://access.redhat.com/security/cve/cve-2014-0161 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161 · Note
• https://t.me/cibsecurity/8949 · Telegram Post