~ / search / GHSA-w3j6-8j34-q43x

GHSA-w3j6-8j34-q43x

Apache Libcloud does not verify SSL certificates for HTTPS connections

Source: GitHub Advisory Database (reviewed) High CVE-2010-4340

Packages

EcosystemPackageAffectedFixed in
PyPI apache-libcloud < 0.4.0 0.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.

References

External links from the advisory. They lead to third-party sites.