{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-12-04T00:00:00", "descriptions": [{"lang": "en", "value": "The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "RHSA-2012:1508", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1508.html"}, {"name": "56825", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/56825"}, {"name": "RHSA-2012:1506", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"name": "RHSA-2012:1505", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1505.html"}, {"name": "enterprise-ssl-certificates-mitm(80544)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80544"}, {"name": "1027838", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1027838"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T18:38:14.953Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2012:1508", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1508.html"}, {"name": "56825", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/56825"}, {"name": "RHSA-2012:1506", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"name": "RHSA-2012:1505", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1505.html"}, {"name": "enterprise-ssl-certificates-mitm(80544)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80544"}, {"name": "1027838", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1027838"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-0861", "datePublished": "2013-01-04T22:00:00", "dateReserved": "2012-01-19T00:00:00", "dateUpdated": "2024-08-06T18:38:14.953Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "229DD47D-ED52-48DF-9849-6AA588A9F533", "versionEndIncluding": "3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "1B952D9C-5ACF-42A4-B249-94E7B5CE0494", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "B84D669D-C083-48FA-A65E-838A904C25C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:2.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "3D562BFD-4E6C-441F-A41D-9FB5EB1D01C1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack."}, {"lang": "es", "value": "El vds_installer en Red Hat Enterprise Virtualization Manager (RHEV-M) anteriores a v3.1, cuando se a\u00f1ade un host, usa el par\u00e1metro \"-k curl\" cuando se descarga deployUtil.py y vds_bootstrap.py, lo que evita que los certificados SSL seran validados y permite a atacantes remotos a ejecutar c\u00f3digo Python a trav\u00e9s de un ataque \"Man in the Middle\"."}], "id": "CVE-2012-0861", "lastModified": "2023-02-13T00:23:04.310", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-01-04T22:55:01.680", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1505.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1508.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/56825"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id?1027838"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80544"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2012:1508", "cpe": "cpe:/a:redhat:enterprise_linux:6::hypervisor", "package": "vdsm-0:4.9.6-44.0.el6_3", "product_name": "RHEV 3.X Hypervisor and Agents for RHEL-6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1505", "cpe": "cpe:/o:redhat:enterprise_linux:6::hypervisor", "package": "rhev-hypervisor6-0:6.3-20121121.0.el6_3", "product_name": "RHEV 3.X Hypervisor and Agents for RHEL-6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1506", "cpe": "cpe:/a:redhat:rhev_manager:3", "package": "org.ovirt.engine-root-0:3.1.0-32", "product_name": "RHEV Manager version 3.0", "release_date": "2012-12-04T00:00:00Z"}], "bugzilla": {"description": "rhev: vds_installer is prone to MITM when downloading 2nd stage installer", "id": "790754", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=790754"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:A/AC:H/Au:N/C:C/I:C/A:C", "status": "verified"}, "cwe": "CWE-295", "details": ["The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack."], "name": "CVE-2012-0861", "package_state": [{"cpe": "cpe:/:redhat:enterprise_linux:::hypervisor", "fix_state": "Will not fix", "package_name": "ovirt-engine-backend", "product_name": "Red Hat Enterprise Virtualization 2"}], "public_date": "2012-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-0861\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-0861"], "statement": "This issue does affect Red Hat Enterprise Virtualization 2 and 3.\nRed Hat Enterprise Virtualization 2 is now in Production 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Virtualization Life Cycle: https://access.redhat.com/support/policy/updates/rhev/.", "threat_severity": "Important"}