id: PYSEC-2020-245
details: ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the
  hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as
  specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle
  attackers to spoof remote endpoints via an arbitrary valid certificate.
affected:
- package:
    name: ovirt-engine-sdk-python
    ecosystem: PyPI
    purl: pkg:pypi/ovirt-engine-sdk-python
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.4.0.7
    - introduced: 3.5.0.0
    - fixed: 3.5.0.4
  versions:
  - 3.3.0.3-1
  - 3.3.0.6-1
  - 3.3.0.7-1
  - 3.3.0.8-1
  - 3.3.5.0
  - 3.4.0.1-1
  - 3.4.0.2
  - 3.4.0.6
references:
- type: WEB
  url: https://access.redhat.com/security/cve/cve-2014-0161
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161
- type: ADVISORY
  url: https://github.com/advisories/GHSA-wf9j-m9fv-92gq
aliases:
- CVE-2014-0161
- GHSA-wf9j-m9fv-92gq
modified: "2021-08-27T03:22:09.942049Z"
published: "2020-01-02T18:15:00Z"