Summary: MITM in fog-kubevirt due disabled certificate validation

Requirements to exploit: Being able to MITM traffic between Satellite
and OpenShift

Component affected: https://github.com/fog/fog-kubevirt

Version affected: <= 1.5.0

Patch available: no

Version fixed (if any already): none

CVSS (optional): N/A

Impact (optional): Important

Embargo: No

Reason: The amount of affected systems should be low
Suggested public date: dd-MMM-yyyy

Acknowledgement: Evgeni Golov

Steps to reproduce if available:

Configure OpenShift Virtualization / KubeVirt in Satellite with
any CA cert provided
See that connections succeed, even if the CA is wrong
Mitigation if available: None

Original report: this email

When foreman_kubevirt sets up a new client, it passes in the CA
provided in the UI to Fog::Kubevirt::Compute [1].
This CA (and the boolean whether SSL verification should happen at
all), is then used in `obtain_ssl_options` to prepare the SSL options
for `kubeclient` [2][3].
However, when the client is actually created, `@opts` is overridden
and contains `verify_ssl => OpenSSL::SSL::VERIFY_NONE` [4].