Apache Libcloud does not verify SSL certificates for HTTPS connections

MITTEL 4.3CVE-2010-4340 · GHSA-w3j6-8j34-q43x · PYSEC-2011-24 · Published 12/09/2011 · updated 16/06/2026

Kurz gesagt

CVE-2010-4340 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in apache-libcloud, libcloud (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.4%, höher als bei 72.3% aller Schwachstellen.
Abhilfe: auf 0.4.0, 0.4.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
apache-libcloud PyPI	`< 0.4.0< 0.4.2`	`0.4.00.4.2`
libcloud apache	`= 0.2.0= 0.3.0= 0.3.1≤ 0.4.0`	No fix yet

Description

libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.

NVD description

libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.

References

Weitere Schwachstellen in apache-libcloud

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free