CVE-2012-3533

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-31 · updated 2026-06-16
Weakness: CWE-310

Description

The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.

Affected products

[UNKNOWN] ovirt-engine: 3.1
Ovirt-Engine-Cli: through 3.1.0.5
Ovirt-Engine-Sdk 3.1.0.5: all versions

References

http://gerrit.ovirt.org/#/c/7209/
http://gerrit.ovirt.org/#/c/7249/
http://secunia.com/advisories/50409
http://www.openwall.com/lists/oss-security/2012/08/24/6
http://www.openwall.com/lists/oss-security/2012/08/26/1
http://www.securityfocus.com/bid/55208
https://bugzilla.redhat.com/show_bug.cgi?id=851672
https://exchange.xforce.ibmcloud.com/vulnerabilities/77984
http://gerrit.ovirt.org/#/c/7209/
http://gerrit.ovirt.org/#/c/7249/
http://secunia.com/advisories/50409
http://www.openwall.com/lists/oss-security/2012/08/24/6

Get alerted when CVE-2012-3533 or the next vulnerability affects your stack