CVE-2013-4111

The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
openstackpython_glanceclient
0.9.0
opensuseopensuse
12.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-glanceclient
bullseye
1:3.2.2-2
fixed
bookworm
1:4.1.0-2
fixed
sid
1:4.7.0-3
fixed
trixie
1:4.7.0-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-glanceclient
saucy
not-affected
raring
Fixed 1:0.9.0-0ubuntu1.2
released
quantal
not-affected
precise
dne
lucid
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html
http://rhn.redhat.com/errata/RHSA-2013-1200.html
http://secunia.com/advisories/54313
http://secunia.com/advisories/54525
http://www.ubuntu.com/usn/USN-2004-1
https://bugs.launchpad.net/ossa/+bug/1192229
https://github.com/openstack/python-glanceclient/blob/master/doc/source/index.rst
http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html
http://rhn.redhat.com/errata/RHSA-2013-1200.html
http://secunia.com/advisories/54313
http://secunia.com/advisories/54525
http://www.ubuntu.com/usn/USN-2004-1
https://bugs.launchpad.net/ossa/+bug/1192229
https://github.com/openstack/python-glanceclient/blob/master/doc/source/index.rst