CVE-2022-2996 python-scciclient vulnerable to Man-in-the-middle (MITM) attacks
Attackers can perform Man-in-the-Middle attacks due to missing certificate verification in python-scciclient HTTPS connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2996?
CVE-2022-2996 is a high-severity vulnerability in Debian Debian Linux, published on 1 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.
Weakness: CWE-295
Which versions are affected by CVE-2022-2996?
3 open source packages ship an affected version, including python-scciclient. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
python-scciclient PyPI | All versions | 0.12.0 |
python-scciclient PyPI | All versions | 0.12.0 |
python-scciclient PyPI | All versions | 0.12.0 |
Linux distribution packages (5)
python-scciclient Red Hat:openstack:16.1::el8 | All versions | 0:0.9.1-2.20220111031440.el8ost |
python3-scciclient Red Hat:openstack:16.1::el8 | All versions | 0:0.9.1-2.20220111031440.el8ost |
python-scciclient Red Hat:openstack:16.2::el8 | All versions | 0:0.9.1-2.20220111031440.el8ost |
python-scciclient Red Hat:openstack:17.0::el9 | All versions | 0:0.10.2-0.20220830130628.b8e6e34.el9ost |
python3-scciclient Red Hat:openstack:17.0::el9 | All versions | 0:0.10.2-0.20220830130628.b8e6e34.el9ost |
Products include Debian Debian Linux, Python-Scciclient Project Python-Scciclient.
How do I fix CVE-2022-2996?
Upgrade python-scciclient to 0.12.0 or later.
Is CVE-2022-2996 being exploited?
There is no known exploitation of CVE-2022-2996 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-2996, DLA-3180-1, GHSA-rf3f-3p37-2qh4, PYSEC-2022-43152, RHSA-2022:8854, RHSA-2022:8868 and 2 more.