CVE-2017-1000256 | BDVDB-2026-92480 Detail

Description#

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.html
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1556251.html
http://www.debian.org/security/2017/dsa-4003
https://access.redhat.com/security/cve/CVE-2017-1000256

Exploit#

No public exploit known

History#

Version 12017-10-31Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.