GitHub Advisory DatabaseGHSA-W3J6-8J34-Q43XApache Libcloud does not verify SSL certificates for HTTPS connections
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.8 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
48.2%
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python’s SSL module rather than directly with libcloud.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache-libcloud | le | 0.4.0 |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463
mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira@thor%3E
mail-archives.apache.org/mod_mbox/incubator-libcloud/201011.mbox/browser
wiki.apache.org/incubator/LibcloudSSL
bugs.python.org/issue1589
github.com/advisories/GHSA-w3j6-8j34-q43x
github.com/apache/libcloud/commit/87ee61e6ba03a43dcefea2ce180988bec066b6fd
issues.apache.org/jira/browse/LIBCLOUD-55
nvd.nist.gov/vuln/detail/CVE-2010-4340
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.8 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
48.2%