Code injection

2018-07-2713:29:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.0%

JSON

It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.

CPENameOperatorVersion
cloudformseq4.5
cloudforms_management_engineeq5.8

CPE	Name	Operator	Version
	cloudforms	eq	4.5
	cloudforms_management_engine	eq	5.8

References

www.securityfocus.com/bid/98769

www.securitytracker.com/id/1038599

access.redhat.com/errata/RHSA-2017:1367

bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2639