PyPI/apache-libcloud CVE-2010-4340: high 7.5, EPSS 1.38%

Apache Libcloud does not verify SSL certificates for HTTPS connections

Action: Upgrade apache-libcloud to 0.4.0 or later.

pip install apache-libcloud==0.4.0

Affected

Fixed versions

Sources

• osv: GHSA-w3j6-8j34-q43x
• https://nvd.nist.gov/vuln/detail/CVE-2010-4340
• https://github.com/apache/libcloud/commit/87ee61e6ba03a43dcefea2ce180988bec066b6fd
• https://bugs.python.org/issue1589
• https://github.com/apache/libcloud
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2011-24.yaml
• https://issues.apache.org/jira/browse/LIBCLOUD-55
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463
• http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira@thor%3E
• http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201011.mbox/browser
• http://wiki.apache.org/incubator/LibcloudSSL

CVE-2010-4340 · published 2022-05-17T05:39:24Z · modified 2024-09-13T14:37:26.441750Z · JSON