GitHub Advisoryadvisory · RubyGems
GHSA-77h8-xr85-3x5q hammer_cli_foreman Improper Certificate Validation vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2017-2667
- Ecosystem
- RubyGems
- Packages
- hammer_cli_foreman
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-295, CWE-345
- Reviewed
- 2023-01-27
Affected packages
• RubyGems hammer_cli_foreman: < 0.10.0 → fixed in 0.10.0
Description
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Related
Alias · CVE (1)
- CVE-2017-2667 Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-2667 advisory
- https://access.redhat.com/errata/RHSA-2018:0336 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1436262 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/hammer_cli_foreman/CVE-2017-2667.yml web
- https://github.com/theforeman/hammer-cli-foreman package
- https://web.archive.org/web/20200227181720/http://www.securityfocus.com/bid/97153 web
- http://projects.theforeman.org/issues/19033 web
- http://www.securityfocus.com/bid/97153 web