A man-in-the-middle vulnerability was reported [1] in Apache Libcloud, due to an invalid regular expression used to validate the target server hostname. When establishing an SSL/TLS connection to a target server, a subset of the full target server hostname was marked as an acceptable match for the given hostname (such as a certificate specifying "aexample.com" being considered acceptable for "example.com"). Upstream version 0.11.1 includes a fix for this flaw. [1] http://seclists.org/fulldisclosure/2012/Aug/55
Created python-libcloud tracking bugs for this issue Affects: fedora-all [bug 845666]
Current Fedora has 0.11.4 which includes this fix.