Bug 1058595 (CVE-2014-0036) - CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client
Summary: CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2014-0036
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1066819 1073189 1073190
Blocks: 1058596
TreeView+ depends on / blocked
 
Reported: 2014-01-28 06:11 UTC by Garth Mollett
Modified: 2021-02-17 06:56 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-15 07:33:30 UTC

Attachments (Terms of Use)
a patch that fixes the issue. (13.79 KB, patch)
2014-02-24 15:22 UTC, Amos Benari 		no flags Details | Diff
always verify peer certificate on https (14.13 KB, patch)
2014-03-02 12:51 UTC, Amos Benari 		no flags Details | Diff
Show Obsolete (1) View All

Description Garth Mollett 2014-01-28 06:11:30 UTC 
Michael Samuel of Amcom reported that the rbovirt rubygem makes unsafe usage of the rest-client gem.
HTTPS requests are sent with SSL verification disabled which could make applications making use of rbovirt vulnerable to MITM attacks.
Comment 1 Garth Mollett 2014-02-19 07:23:21 UTC 
Acknowledgements:

Red Hat would like to thank Michael Samuel of Amcom for reporting this issue.
Comment 3 Amos Benari 2014-02-24 15:22:41 UTC 
Created attachment 866995 [details]
a patch that fixes the issue.
Comment 4 Amos Benari 2014-03-02 12:51:14 UTC 
Created attachment 869621 [details]
always verify peer certificate on https
Comment 5 Garth Mollett 2014-03-06 01:24:56 UTC 
Created rubygem-rbovirt tracking bugs for this issue:

Affects: fedora-all [bug 1073189]
Affects: epel-6 [bug 1073190]
Comment 6 Fedora Update System 2014-03-15 15:18:00 UTC 
rubygem-rbovirt-0.0.18-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2014-03-15 15:23:28 UTC 
rubygem-rbovirt-0.0.18-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2014-03-21 22:32:39 UTC 
rubygem-rbovirt-0.0.6-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.