CVE-2013-4111

python-glanceclient < 0.10.0 - SSL Certificate Validation Bypass via Improper preverify_ok Handling

Title source: llm
STIX 2.1

Description

The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (7)

Core 7
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54525
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54313
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2004-1
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1200.html
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/ossa/+bug/1192229
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html

Scores

EPSS 0.0029
EPSS Percentile 51.9%

Details

CWE
CWE-20
Status published
Products (3)
openstack/python_glanceclient 0.9.0
opensuse/opensuse 12.3
pypi/python-glanceclient 0 - 0.10.0PyPI
Published Aug 28, 2013
Tracked Since Feb 18, 2026