Bug 1083303 (CVE-2014-0161)

Summary:	CVE-2014-0161 ovirt-engine-sdk-python: does not verify that the remote endpoint's hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jrusnack, security-response-team, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-04 18:40:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1082595, 1198753, 1198754
Bug Blocks:	1083304

Description Vincent Danen 2014-04-01 21:48:31 UTC

It was reported [1] that oVirt's Python SDK does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session.  This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary yet valid certificate.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1082595

Comment 1 Kurt Seifried 2015-03-04 18:30:54 UTC

Created ovirt-engine-sdk-python tracking bugs for this issue:

Affects: fedora-all [bug 1198753]
Affects: epel-6 [bug 1198754]