Vulnerability in Openstack Swift
CVE-2013-6396
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a craf…
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.001 (33.4th percentile) — read the EPSS interpretation.
Affected products
- Openstack Swift — versions 1.0.0, 1.0.1, 1.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- [oss-security] 20140217 [OSSA 2014-005] Missing SSL certificate check in Python Swift client (CVE-2013-6396) (mailing-list, x_refsource_MLIST)