CVE-2012-5518 Auth bypass in vdsm
Improper certificate validation in vdsm allows attackers with matching keys to bypass authentication and execute arbitrary commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-5518?
CVE-2012-5518 is a high-severity authentication bypass vulnerability in vdsm, published on 25 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)
Weakness: CWE-295
Which versions are affected by CVE-2012-5518?
It affects 1 product.
Products include Ovirt Vdsm.
How do I fix CVE-2012-5518?
No fix has been published for CVE-2012-5518 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2012-5518 being exploited?
There is no known exploitation of CVE-2012-5518 in the wild and no public exploit code.
Other vulnerabilities in vdsm
Sources
Also known as GHSA-vvr9-cxf3-4gvj.