Описание
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
Ссылки
- Third Party Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Third Party Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 2.3.0 (включая) до 3.9.0 (исключая)
cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
EPSS
Процентиль: 61%
0.00425
Низкий
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-295
Связанные уязвимости
CVSS3: 8.1
ubuntu
больше 7 лет назад
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
CVSS3: 5
redhat
больше 7 лет назад
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
CVSS3: 8.1
debian
больше 7 лет назад
libvirt version 2.3.0 and later is vulnerable to a bad default configu ...
EPSS
Процентиль: 61%
0.00425
Низкий
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-295