—

PYSEC-2020-245

Quick fix

PYSEC-2020-245 — ovirt-engine-sdk-python: upgrade to the fixed version with the command below.

pip install --upgrade 'ovirt-engine-sdk-python>=3.4.0.7'

Details

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/ovirt-engine-sdk-python

Introduced in: 0Fixed in: 3.4.0.7

Fixpip install --upgrade 'ovirt-engine-sdk-python>=3.4.0.7'

References

https://access.redhat.com/security/cve/cve-2014-0161[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161[REPORT]
https://github.com/advisories/GHSA-wf9j-m9fv-92gq[ADVISORY]