What is GHSA-wf9j-m9fv-92gq?

GHSA-wf9j-m9fv-92gq is a security advisory published by GitHub Security Advisories with High severity. ovirt-engine-sdk-python improper validation of hostname in x.509 certificate

Which CVE IDs does GHSA-wf9j-m9fv-92gq cover?

GHSA-wf9j-m9fv-92gq covers the following CVE IDs: CVE-2014-0161. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wf9j-m9fv-92gq?

GHSA-wf9j-m9fv-92gq has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-wf9j-m9fv-92gq?

GHSA-wf9j-m9fv-92gq affects 2 products, including: pip/ovirt-engine-sdk-python:\u003c 3.4.0.7; pip/ovirt-engine-sdk-python:\u003e= 3.5.0.0, \u003c 3.5.0.4.

GHSA-wf9j-m9fv-92gqHighCVSS 5.9

ovirt-engine-sdk-python improper validation of hostname in x.509 certificate

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 8, 2024

🔗 CVE IDs covered (1)

CVE-2014-0161 →

📋 Description

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

🎯 Affected products2

pip/ovirt-engine-sdk-python:< 3.4.0.7
pip/ovirt-engine-sdk-python:>= 3.5.0.0, < 3.5.0.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2014-0161
https://access.redhat.com/security/cve/cve-2014-0161
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161
https://github.com/pypa/advisory-database/tree/main/vulns/ovirt-engine-sdk-python/PYSEC-2020-245.yaml
https://github.com/advisories/GHSA-wf9j-m9fv-92gq