CVE-2017-2667 : Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.

Published 2018-03-12 15:29:01

Updated 2024-01-26 17:46:13

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2017-2667

Redhat » Satellite » Version: 6.3
cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*
Matching versions
Redhat » Satellite Capsule » Version: 6.3
cpe:2.3:a:redhat:satellite_capsule:6.3:*:*:*:*:*:*:*
Matching versions
Theforeman » Hammer Cli
Versions before (<) 0.10.0
cpe:2.3:a:theforeman:hammer_cli:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-2667

EPSS FAQ

0.32%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-2667

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST	2024-01-26
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-2667

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Assigned by: secalert@redhat.com (Secondary)

References for CVE-2017-2667

http://www.securityfocus.com/bid/97153

hammer_cli CVE-2017-2667 SSL Certificate Validation Security Bypass Vulnerability
Broken Link;Third Party Advisory;VDB Entry
http://projects.theforeman.org/issues/19033

Bug #19033: CVE-2017-2667 - SSL/HTTPS server certificates are not verified by default - Hammer CLI - Foreman
Issue Tracking;Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0336

RHSA-2018:0336 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1436262

1436262 – (CVE-2017-2667) CVE-2017-2667 rubygem-hammer_cli: no verification of API server's SSL certificate
Issue Tracking

Jump to

Vulnerability Details : CVE-2017-2667

Products affected by CVE-2017-2667

Exploit prediction scoring system (EPSS) score for CVE-2017-2667

CVSS scores for CVE-2017-2667

CWE ids for CVE-2017-2667

References for CVE-2017-2667