CVE-2017-1000256

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-4003Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-1000256Issue Tracking, Vendor Advisory
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1556251.html
https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.htmlIssue Tracking, Vendor Advisory
http://www.debian.org/security/2017/dsa-4003Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-1000256Issue Tracking, Vendor Advisory
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1556251.html
https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.htmlIssue Tracking, Vendor Advisory

Timeline

Published: Oct 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10002579.1An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, lib CVE-2017-100034.5Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Network Services Library). The supported version CVE-2017-10003539.8Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthent CVE-2017-10003548.8Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkin CVE-2017-10003556.5Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void CVE-2017-10003568.8Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication r CVE-2017-10003577.5Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight CVE-2017-10003586.5Controller throws an exception and does not allow user to add subsequent flow for a particular switch. Component: OpenDaylight odl-restconf CVE-2017-10003595.3Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw CVE-2017-10003605.3StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: CVE-2017-10003617.5DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CVE-2017-10003629.8The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a back