5.8
CVSSv2

CVE-2013-4111

Published: 28/08/2013 Updated: 13/02/2023
CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6
VMScore: 516
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

Vulnerability Summary

The Python client library for Glance (python-glanceclient) prior to 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle malicious users to spoof SSL servers via an arbitrary valid certificate.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openstack python glanceclient 0.9.0

opensuse opensuse 12.3

Vendor Advisories

Synopsis Moderate: python-glanceclient security update Type/Severity Security Advisory: Moderate Topic An updated python-glanceclient package that fixes one security issue is nowavailable for Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having moderatesecurity impact A ...
python-glanceclient could be made to expose sensitive information over the network ...
Debian Bug report logs - #730626 python-swiftclient: CVE-2013-6396 Package: python-swiftclient; Maintainer for python-swiftclient is Debian OpenStack <team+openstack@trackerdebianorg>; Source for python-swiftclient is src:python-swiftclient (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> ...
Debian Bug report logs - #718282 CVE-2013-4111: Missing SSL certificate check in Python glance client Package: python-glanceclient; Maintainer for python-glanceclient is Debian OpenStack <team+openstack@trackerdebianorg>; Source for python-glanceclient is src:python-glanceclient (PTS, buildd, popcon) Reported by: Thomas Go ...
The Python client library for Glance (python-glanceclient) before 0100 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbit ...