GHSA-w3j6-8j34-q43x

Source

https://github.com/advisories/GHSA-w3j6-8j34-q43x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w3j6-8j34-q43x/GHSA-w3j6-8j34-q43x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w3j6-8j34-q43x

Aliases

Published

2022-05-17T05:39:24Z

Modified

2024-09-13T14:37:26Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Apache Libcloud does not verify SSL certificates for HTTPS connections

Details

libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.

Database specific

{
    "cwe_ids":  [
        "CWE-295"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-02-23T20:59:34Z",
    "nvd_published_at":  "2011-09-12T12:41:00Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / apache-libcloud

Package

Name: apache-libcloud; View open source insights on deps.dev
Purl: pkg:pypi/apache-libcloud

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4.0

Affected versions

0.*

0.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w3j6-8j34-q43x/GHSA-w3j6-8j34-q43x.json"