CVE-2017-2639

EUVD-2017-11799
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
redhatCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
redhatcloudforms
4.5
redhatcloudforms_management_engine
5.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/98769
http://www.securitytracker.com/id/1038599
https://access.redhat.com/errata/RHSA-2017:1367
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2639
http://www.securityfocus.com/bid/98769
http://www.securitytracker.com/id/1038599
https://access.redhat.com/errata/RHSA-2017:1367
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2639