CVE-2013-4111: Python Glanceclient SSL Server Spoofing
Summary
CVE-2013-4111: The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common N... Affects python-glanceclient versions < 0.10.0. Fixed in 0.10.0. How to fix ↓
Also tracked for
- python-glanceclient · Debian:11
The same CVE-2013-4111 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Glanceclient is a Python client library for Glance, an image service for OpenStack. It provides a command-line interface (CLI) and a set of Python APIs for interacting with Glance. This vulnerability affects versions of python-glanceclient prior to 0.10.0. Glanceclient uses SSL/TLS to establish secure connections with Glance servers. However, the library does not properly verify the server hostname, allowing an attacker to spoof SSL servers using a valid certificate with an arbitrary domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate.
Vulnerability Detail
The vulnerability in python-glanceclient allows a man-in-the-middle attacker to intercept and manipulate the communication between the client and the server. By presenting a valid SSL certificate with a spoofed domain name, the attacker can impersonate the legitimate server and potentially gain unauthorized access to sensitive information or perform malicious actions on behalf of the client. This can lead to various security risks, including data breaches, unauthorized access, and integrity violations.
How To Fix
Minimum fixed version
0.10.0
This is the first release that contains the fix.
pip install --upgrade "python-glanceclient==0.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The python-glanceclient library prior to version 0.10.0 is vulnerable to SSL server spoofing, allowing an attacker to impersonate legitimate servers. To mitigate this vulnerability, it is crucial to upgrade to python-glanceclient 0.10.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-glanceclient →
FAQ
You can check the version of python-glanceclient installed by running the following command:
pip show python-glanceclient
Unfortunately, there is no known workaround for this vulnerability. It is recommended to upgrade python-glanceclient to the fixed version.
No, only versions prior to 0.10.0 are affected. It is recommended to upgrade to version 0.10.0 or later.
Yes, this vulnerability can be exploited remotely by a man-in-the-middle attacker intercepting the communication between the client and the server.
The potential consequences of this vulnerability include unauthorized access to sensitive information, data breaches, and integrity violations.
Related vulnerabilities
Recent vulnerabilities recorded for python-glanceclient.
