HIGH
libvirt: TLS certificate verification disabled for clients
Published Oct 31, 2017
8.1
HIGHCVSS 3.1
EPSS 1.71%
Description
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
Affected products
No data.
Configuration 2
- 9.0
No data.
Red Hat Enterprise Linux 5
libvirt
Will not fix
Red Hat Enterprise Linux 6
libvirt
Will not fix
Red Hat Enterprise Linux 7
libvirt
Will not fix
Red Hat Enterprise Virtualization 3
mingw-virt-viewer
Will not fix
Red Hat Storage 3
libvirt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | libvirt | Will not fix | n/a |
| Red Hat Enterprise Linux 6 | libvirt | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | libvirt | Will not fix | n/a |
| Red Hat Enterprise Virtualization 3 | mingw-virt-viewer | Will not fix | n/a |
| Red Hat Storage 3 | libvirt | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (7)
- http://www.debian.org/security/2017/dsa-4003 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-1000256 x_refsource_CONFIRMIssue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1503658 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000256
- https://www.cve.org/CVERecord?id=CVE-2017-1000256
- https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1556251.html x_refsource_MISC
- https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.html mailing-listx_refsource_MLISTIssue TrackingVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.debian.org/security/2017/dsa-4003 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2017-1000256 | x_refsource_CONFIRMIssue TrackingVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1503658 | Issue Tracking | |
| https://nvd.nist.gov/vuln/detail/CVE-2017-1000256 | ||
| https://www.cve.org/CVERecord?id=CVE-2017-1000256 | ||
| https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1556251.html | x_refsource_MISC | |
| https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.html | mailing-listx_refsource_MLISTIssue TrackingVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 31, 2017
Updated Aug 5, 2024
Reserved Oct 18, 2017
Link CVE-2017-1000256
CISA Vulnrichment
Updated n/a