CVE-2017-1000256
Fixed in a distro release EPSS 2%
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
Products: redhat libvirt, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.5 | libvirt | 2.5.0-r2 |
| Alpine 3.6 | libvirt | 3.3.0-r2 |
| Debian 12 | libvirt | 3.8.0-3 |
| Debian 13 | libvirt | 3.8.0-3 |
| Debian 14 | libvirt | 3.8.0-3 |
| Debian 9 | libvirt | 3.0.0-4+deb9u1 |
| SUSE Linux Enterprise Desktop 12 SP3 | libvirt | 3.3.0-5.8.1 |
| SUSE Linux Enterprise Server 12 SP3 | libvirt | 3.3.0-5.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libvirt | 3.3.0-5.8.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libvirt | 3.3.0-5.8.1 |
| Ubuntu 14.04 LTS | libvirt | 1.2.2-0ubuntu13.1.26 |
| Ubuntu 16.04 LTS | libvirt | 1.3.1-1ubuntu10.19 |
| openSUSE Tumbleweed | libvirt | 7.7.0-2.1 |