Unscored severity · published Aug 31, 2012
CVE-2012-3533
The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a…
–
CVSS
1.1%
EPSS
No
On KEV
Description
The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
31
3.1.0.5 · Ovirt-engine-sdk
All versions, or not specified · source: NVD
OV
Ovirt · Ovirt
3.1 · source: NVD
OV
Ovirt-engine-cli · Ovirt
through 3.1.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3533
gerrit.ovirt.org
http://gerrit.ovirt.org/#/c/7209/
gerrit.ovirt.org
http://gerrit.ovirt.org/#/c/7249/
Vendor Advisory
http://secunia.com/advisories/50409
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/24/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/26/1
www.securityfocus.com
http://www.securityfocus.com/bid/55208
More from Ovirt
9.8
CVE-2018-1072
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
8.1
CVE-2019-3879
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be…
7.8
CVE-2018-1075
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning
7.5
CVE-2014-7851
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session…
7.2
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to…