Date: Sun, 26 Aug 2012 10:14:15 +0300 From: Michael Pasternak <mpastern@...hat.com> To: vdanen@...hat.com, oss-security@...ts.openwall.com Subject: Re: oVirt 3.1 does not validate server certificates in python sdk and cli (CVE-2012-3533) Hi Vincent, Fix for the mentioned issue available in: sdk: 220.127.116.11 cli: 18.104.22.168 > > Hi folks. This is a heads-up for anyone who may be shipping oVirt. > oVirt 3.1 added a new python SDK and CLI which do various fancy things. > It supports connecting to servers over SSL, but did not have support for > validating certificates, which could lead to a mitm attack. > > I've assigned CVE-2012-3533 to this issue. It is corrected in git > already. > > References: > > http://wiki.ovirt.org/wiki/Release_Notes#Interfaces > http://gerrit.ovirt.org/#/c/7209/ > http://gerrit.ovirt.org/#/c/7249/ > https://bugzilla.redhat.com/show_bug.cgi?id=851672 > > -- > > Vincent Danen / Red Hat Security Response Team -- Michael Pasternak RedHat, ENG-Virtualization R&D
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ