« Volver al listado

CVE-2013-4111

Estado: ModificadaMedia (5.8)—

The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Openstack — Python GlanceclientOpensuse — Opensuse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4111",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-28T21:55:08.740",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1200.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/54313",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/54525",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2004-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.launchpad.net/ossa/+bug/1192229",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/openstack/python-glanceclient/blob/master/doc/source/index.rst",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-08/msg00019.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1200.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/54313",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/54525",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2004-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/ossa/+bug/1192229",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/openstack/python-glanceclient/blob/master/doc/source/index.rst",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."
    },
    {
      "lang": "es",
      "value": "La biblioteca cliente Python para Glance (python-glanceclient) anterior a v0.10.0 no comprueba correctamente el valor preverify_ok, lo que impide que el nombre del servidor sea verificado con un nombre de dominio en el nombre común del sujeto (CN) o el campo subjectAltName de un certificado X.509, permitiendo a los atacantes de hombre-en-medio (man-in-the-middle) falsificar servidores SSL mediante un certificado valido de su elección."
    }
  ],
  "lastModified": "2026-06-16T23:56:38.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.4.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "96F8151E-BD04-4E21-AE47-4FDD58F105F4"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.4.1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3436E5A2-D639-4482-8097-12722115AF04"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.4.2:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "91697740-66F5-44FE-8DAD-3093260FFE9D"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.5.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4B54B9CF-3758-4945-8CA3-B404338350E0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.5.1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4BFB15D1-FD78-46F2-A123-E920D820A474"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.6.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "16D71B16-A057-4804-9B7B-DDDCC1E16981"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.7.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8D2902F2-DACD-4636-B853-007561D9B69A"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.8.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9788B2B7-214F-449C-94C8-4FF6D79586A5"
            },
            {
              "criteria": "cpe:2.3:a:openstack:python_glanceclient:0.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F0F8811-52DE-4644-8361-9638878FB40B"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}