REDHAT-BUG-2302865: Medium severity libguestfs vulnerability

Published Aug 5, 2024

Updated

A flaw was found in libnbd. A client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This would allow a man-in-the-middle attack on NBD traffic. After investigation, several separate related problems were found.

Reference: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2

Affected Software

1 affected component

libguestfs libnbd

Event History

Aug 5, 2024

Data Sourced

via Red Hat·01:03 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2302865?

The severity of REDHAT-BUG-2302865 is significant due to its potential for allowing man-in-the-middle attacks on NBD traffic.

How do I fix REDHAT-BUG-2302865?

To fix REDHAT-BUG-2302865, ensure to update to the latest version of libnbd that addresses the TLS certificate verification issue.

What software is affected by REDHAT-BUG-2302865?

The affected software for REDHAT-BUG-2302865 includes libguestfs and specifically the libnbd component.

What type of attacks can REDHAT-BUG-2302865 allow?

REDHAT-BUG-2302865 can potentially allow man-in-the-middle attacks due to improper TLS certificate verification.

Is there a workaround for REDHAT-BUG-2302865?

Currently, the recommended approach for REDHAT-BUG-2302865 is to update the software, as no official workaround is documented.