CVE-2013-4111

Published: 28/08/2013 Updated: 13/02/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

The Python client library for Glance (python-glanceclient) prior to 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle malicious users to spoof SSL servers via an arbitrary valid certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openstack python glanceclient 0.9.0
opensuse opensuse 12.3

Synopsis Moderate: python-glanceclient security update Type/Severity Security Advisory: Moderate Topic An updated python-glanceclient package that fixes one security issue is nowavailable for Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having moderatesecurity impact A ...

python-glanceclient could be made to expose sensitive information over the network ...

Debian Bug report logs - #730626 python-swiftclient: CVE-2013-6396 Package: python-swiftclient; Maintainer for python-swiftclient is Debian OpenStack <team+openstack@trackerdebianorg>; Source for python-swiftclient is src:python-swiftclient (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> ...

Debian Bug report logs - #718282 CVE-2013-4111: Missing SSL certificate check in Python glance client Package: python-glanceclient; Maintainer for python-glanceclient is Debian OpenStack <team+openstack@trackerdebianorg>; Source for python-glanceclient is src:python-glanceclient (PTS, buildd, popcon) Reported by: Thomas Go ...

The Python client library for Glance (python-glanceclient) before 0100 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbit ...

CWE-20 http://secunia.com/advisories/54525 https://github.com/openstack/python-glanceclient/blob/master/doc/source/index.rst http://secunia.com/advisories/54313 https://bugs.launchpad.net/ossa/+bug/1192229 http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html http://rhn.redhat.com/errata/RHSA-2013-1200.html http://www.ubuntu.com/usn/USN-2004-1 https://access.redhat.com/errata/RHSA-2013:1200 https://nvd.nist.gov https://usn.ubuntu.com/2004-1/https://access.redhat.com/security/cve/cve-2013-4111

CVE-2013-4111

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect