GoogleOSV:GHSA-W3J6-8J34-Q43XApache Libcloud does not verify SSL certificates for HTTPS connections
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python’s SSL module rather than directly with libcloud.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache-libcloud | eq | 0.3.1 | |
| apache-libcloud | eq | 0.4.0 |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463
mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira@thor%3E
mail-archives.apache.org/mod_mbox/incubator-libcloud/201011.mbox/browser
wiki.apache.org/incubator/LibcloudSSL
bugs.python.org/issue1589
github.com/apache/libcloud
github.com/apache/libcloud/commit/87ee61e6ba03a43dcefea2ce180988bec066b6fd
issues.apache.org/jira/browse/LIBCLOUD-55
nvd.nist.gov/vuln/detail/CVE-2010-4340
Related
