CVE-2015-3908

Aliases:GHSA-w64c-pxjj-h866PYSEC-2015-1
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 12 Aug 2015, 14:00
Last modified:06 Aug 2024, 05:56

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
0.22% LOW
0% probability +0.14%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Aug 2015, 14:00
Published
Vulnerability first disclosed
06 Aug 2024, 05:56
Last Modified
Vulnerability information updated

Description

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.22%• Percentile: 44%

Techniques & Countermeasures

  • CWE-345•Insufficient Verification of Data Authenticity

    The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Systems

  • PyPI•ansible

    < 1.9.2

  • redhat•ansible

    ≤ 1.9.1

References (9)