CVE-2014-0161: ovirt-engine-sdk-python TLS/SSL Endpoint Spoofing
Summary
CVE-2014-0161: ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. Affects ovirt-engine-sdk-python across 2 version ranges.
< 3.4.0.7
>= 3.5.0.0, < 3.5.0.4
Fixed in 3.4.0.7 or 3.5.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ovirt-engine-sdk-python package is a Python software development kit (SDK) for the oVirt Engine API. It provides a high-level object-oriented API for managing oVirt virtualization environments. The package allows users to interact with the oVirt Engine API to perform various operations such as creating and managing virtual machines, storage domains, and networks. This vulnerability affects versions before 3.4.0.7 and 3.5.0.4 of the package.
Vulnerability Detail
The ovirt-engine-sdk-python package does not properly verify the hostname of the remote endpoint during a TLS/SSL session. This means that it does not check if the Common Name (CN) or subjectAltName specified in the x.509 certificate of the remote endpoint matches the actual hostname. As a result, an attacker with a valid certificate could perform a man-in-the-middle attack and spoof the remote endpoint, potentially leading to unauthorized access or data interception. This vulnerability was assigned CVE-2014-0161.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.4.0.73.4.0.7pip install --upgrade "ovirt-engine-sdk-python==3.4.0.7" -
>= 3.5.0.0, < 3.5.0.43.5.0.4pip install --upgrade "ovirt-engine-sdk-python==3.5.0.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The ovirt-engine-sdk-python package before versions 3.4.0.7 and 3.5.0.4 is vulnerable to TLS/SSL endpoint spoofing. Users should upgrade to the fixed versions to ensure proper verification of the remote endpoint's hostname during TLS/SSL sessions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ovirt-engine-sdk-python →
FAQ
This vulnerability allows an attacker with a valid certificate to spoof the remote endpoint, potentially leading to unauthorized access or data interception.
You can use the Vulert Playground at Vulert Scanner to check if your version of ovirt-engine-sdk-python is affected by this vulnerability. Simply enter your Pipfile.lock file and the Vulert Playground will provide real-time alerts for open-source vulnerabilities.
There are no known exploits for this vulnerability at the moment.
There is no evidence of this vulnerability being exploited in the wild.
You can find more information about this vulnerability in the advisory database of the PyPA organization. The source for this vulnerability is available at https://github.com/pypa/advisory-database/blob/main/vulns/ovirt-engine-sdk-python/PYSEC-2020-245.yaml.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
