Описание
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Ссылки
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Mailing List
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Mailing List
Уязвимые конфигурации
EPSS
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Ansible before 1.9.2 does not verify that the server hostname matches ...
Ansible does not verify that the server hostname matches a domain name in certificates
EPSS
4.3 Medium
CVSS2