CVE-2014-0161

oVirt Engine SDK Python <3.4.0.7 and <3.5.0.4: TLS hostname verification bypass, allowing man-in-the-middle attacks

• CVSS 5.9
• CWE-295 Improper Certificate Validation
• Cryptographic
• Remote

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

CVE

CVE-2014-0161

CWE

CWE-295 Improper Certificate Validation

CVSS base score

5.9

Published

2020-01-02

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update ovirt-engine-sdk-python to version 3.5.0.4 or higher.

import ssl
import socket

def create_ssl_context():
    """Vulnerable function that demonstrates the security issue."""
    context = ssl.create_default_context()
    context.check_hostname = False
    context.verify_mode = ssl.CERT_NONE
    return context

def connect_to_server(hostname, port):
    """Vulnerable function that demonstrates the security issue."""
    context = create_ssl_context()
    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock) as ssock:
            print(f'Successfully connected to {hostname} on port {port}')

connect_to_server('example.com', 443)

import ssl
import socket

def create_ssl_context():
    """Secure function that fixes the vulnerability."""
    context = ssl.create_default_context()
    context.check_hostname = True
    context.verify_mode = ssl.CERT_REQUIRED
    return context

def connect_to_server(hostname, port):
    """Secure function that fixes the vulnerability."""
    context = create_ssl_context()
    with socket.create_connection((hostname, port)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            print(f'Successfully connected to {hostname} on port {port}')

connect_to_server('example.com', 443)

@misc{vaitp:cve20140161,
  title        = {{oVirt Engine SDK Python <3.4.0.7 and <3.5.0.4: TLS hostname verification bypass, allowing man-in-the-middle attacks}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-0161},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-0161/}}
}