Bug 831947 (CVE-2013-4111) - VUL-1: CVE-2013-4111: openstack-glance: missing ssl certificate check
Summary: VUL-1: CVE-2013-4111: openstack-glance: missing ssl certificate check
Status: RESOLVED FIXED
Alias: CVE-2013-4111
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Sascha Peilicke
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-29 14:10 UTC by Matthias Weckbecker
Modified: 2013-10-02 18:44 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Matthias Weckbecker 2013-07-29 14:15:42 UTC 
Patch available from openstack.org [1].

[1] https://review.openstack.org/#/c/33464/8/glanceclient/common/http.py,unified
Comment 2 Sascha Peilicke 2013-08-05 08:49:45 UTC 
Doesn't apply to Essex, so no Cloud-1 update necessary. Fix backported to Cloud:OpenStack:Folsom. Maintenance update for 12.3 submitted: sr#185899
Comment 3 Bernhard Wiedemann 2013-08-05 09:00:31 UTC 
This is an autogenerated message for OBS integration:
This bug (831947) was mentioned in
https://build.opensuse.org/request/show/185899 Maintenance /
Comment 4 Marcus Meissner 2013-08-13 21:18:13 UTC 
released
Comment 5 Swamp Workflow Management 2013-08-14 01:04:23 UTC 
openSUSE-SU-2013:1330-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 831947
CVE References: CVE-2013-4111
Sources used:
openSUSE 12.3 (src):    python-glanceclient-0.6.0.14.gc057fe4+git.1355912586.c057fe4-2.4.1
Comment 6 Marcus Meissner 2013-10-02 18:44:34 UTC 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4111

The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.