Описание
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Enterprise 3 | ansible | Not affected | ||
| Red Hat OpenStack Platform 10 (Newton) | ansible | Not affected | ||
| Red Hat Quickstart Cloud Installer 1 | ansible | Not affected | ||
| Red Hat Storage 3 | ansible | Not affected | ||
| Red Hat Storage Console 2 | ansible | Not affected |
Показывать по
Дополнительная информация
Статус:
7.6 High
CVSS2
Связанные уязвимости
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Ansible before 1.9.2 does not verify that the server hostname matches ...
Ansible does not verify that the server hostname matches a domain name in certificates
ALT-PU-2015-1579: package `ansible` update to version 1.9.2-alt1
7.6 High
CVSS2