CVE-2014-0161

Name of the Vulnerable Software and Affected Versions ovirt-engine-sdk-python versions prior to 3.4.0.7 ovirt-engine-sdk-python versions prior to 3.5.0.4

Description The issue arises from the failure to verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

Recommendations For versions prior to 3.4.0.7, update to version 3.4.0.7 or later. For versions prior to 3.5.0.4, update to version 3.5.0.4 or later.