CVE-2014-0161 ovirt-engine-sdk-python improper validation of hostname in x.509 certificate
The Python SDK fails to verify TLS certificate hostnames, allowing man-in-the-middle attackers to spoof remote endpoints using valid certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0161?
CVE-2014-0161 is a medium-severity vulnerability in ovirt-engine-sdk-python, published on 2 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.
Weakness: CWE-295
Which versions are affected by CVE-2014-0161?
5 open source packages ship an affected version, including ovirt-engine-sdk-python. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ovirt-engine-sdk-python PyPI | All versions | 3.4.0.7, 3.5.0.4 |
ovirt-engine-sdk-python PyPI | All versions | 3.4.0.7 |
ovirt-engine-sdk-python PyPI | All versions | 3.4.0.7 |
ovirt-engine-sdk-python PyPI | From 3.5.0.0 | 3.5.0.4 |
ovirt-engine-sdk-python PyPI | From 3.5.0.0 | 3.5.0.4 |
Products include Ovirt-Engine-Sdk-Python Project Ovirt-Engine-Sdk-Python.
How do I fix CVE-2014-0161?
Upgrade ovirt-engine-sdk-python to a fixed version for your release line: 3.4.0.7 or 3.5.0.4.
Is CVE-2014-0161 being exploited?
There is no known exploitation of CVE-2014-0161 in the wild and no public exploit code.
Sources
Also known as GHSA-wf9j-m9fv-92gq, PYSEC-2020-245.