CVE-2024-7383: Libnbd: nbd server improper certificate validation
A flaw was found in libnbd. A client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This would allow a man-in-the-middle attack on NBD traffic. After investigation, several separate related problems were found.
Reference: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2
Other sources
A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.
— NVD
Libnbd: nbd server improper certificate validation
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7383?
CVE-2024-7383 is considered to have a high severity due to the potential for man-in-the-middle attacks.
How do I fix CVE-2024-7383?
To fix CVE-2024-7383, ensure that the latest version of libnbd is applied, where the certificate verification has been implemented correctly.
What causes CVE-2024-7383?
CVE-2024-7383 is caused by insufficient verification of the NBD server's certificate when using TLS, leading to security vulnerabilities.
What are the potential impacts of CVE-2024-7383?
The potential impacts of CVE-2024-7383 include unauthorized access and interception of NBD traffic due to man-in-the-middle attacks.
Which software is affected by CVE-2024-7383?
CVE-2024-7383 affects libnbd as part of the libguestfs suite.