Описание
A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when the Python client fails to adequately verify the server's certificate against its hostname, potentially enabling a man-in-the-middle (MITM) attack and leading to information disclosure.
Отчет
Moderate: This flaw in Apache Thrift Python bindings could lead to information disclosure due to improper certificate validation, allowing a remote attacker with high attack complexity to intercept sensitive data without requiring user interaction or privileges. While Red Hat Enterprise Linux AI is not affected, OpenShift Container Platform, Red Hat OpenShift Update Service, and Confidential Compute Attestation are impacted where these bindings are used in network communication.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-podvm-payload-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | thrift | Not affected | ||
| Red Hat OpenShift Container Platform 4 | conmon-rs | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | kata-containers | Fix deferred | ||
| Red Hat OpenShift Update Service | openshift-update-service/openshift-update-service-rhel8 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603
Improper Validation of Certificate with Host Mismatch vulnerability in ...
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603
EPSS
5.9 Medium
CVSS3