CVE-2017-2639

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26409.8An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use CVE-2017-26419.8In Moodle 2.x and 3.x, SQL injection can occur via user preferences.CVE-2017-26426.5Moodle 3.x has user fullname disclosure on the user preferences page.CVE-2017-26435.3In Moodle 3.2.x, global search displays user names for unauthenticated users.CVE-2017-26446.1In Moodle 3.x, XSS can occur via evidence of prior learning.CVE-2017-26456.1In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.CVE-2017-26467.5It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestPar CVE-2017-26477.8The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer derefere CVE-2017-26485.6It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle at CVE-2017-26498.1It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Director CVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm CVE-2017-26513.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically