CVE-2015-3229

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download Fedora Atomic updates.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/06/12/8Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/75185Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1231800Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/spins%40lists.fedoraproject.org/thread/L3GSGM5JS2EAJJAGEHR7U4ATNM4ILFKK/
http://www.openwall.com/lists/oss-security/2015/06/12/8Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/75185Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1231800Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/spins%40lists.fedoraproject.org/thread/L3GSGM5JS2EAJJAGEHR7U4ATNM4ILFKK/

Timeline

Published: Oct 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-32307.5389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSo CVE-2015-32314.0The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain priv CVE-2015-32325.8Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web site CVE-2015-32335.8Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites CVE-2015-32344.3The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an O CVE-2015-32356.0Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwords CVE-2015-32365.0cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_e CVE-2015-32376.4The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memo CVE-2015-32386.5The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, a CVE-2015-32393.3Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via CVE-2015-32404.3The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of CVE-2015-32416.8OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, wh