CVE-2017-2667: High severity foreman hammer cli vulnerability
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Other sources
Tomas Strachota of Red Hat reports:
It was found that Hammer CLI, a CLI utility for Foreman, did not explicitly set the verifyssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Upstream issue:
http://projects.theforeman.org/issues/19033
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2667?
CVE-2017-2667 has been classified as a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2017-2667?
To fix CVE-2017-2667, upgrade Hammer CLI for Foreman to version 0.10.0 or later.
Who reported CVE-2017-2667?
CVE-2017-2667 was reported by Tomas Strachota of Red Hat.
What is affected by CVE-2017-2667?
CVE-2017-2667 affects versions of Hammer CLI for Foreman prior to 0.10.0.
What types of attacks are possible due to CVE-2017-2667?
CVE-2017-2667 allows for man-in-the-middle attacks due to the lack of SSL certificate verification.