GitHub Advisoryadvisory · PyPI

GHSA-w3j6-8j34-q43x Apache Libcloud does not verify SSL certificates for HTTPS connections

HIGH Published 2022-05-17 Modified 2024-09-13 Official page ↗
Aliases
CVE-2010-4340
Ecosystem
PyPI
Packages
apache-libcloud
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2024-02-23

Affected packages

• PyPI apache-libcloud: < 0.4.0 → fixed in 0.4.0

Description

libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.

Related

Alias · CVE (1)

  • CVE-2010-4340 libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References