Project

General

Profile

Actions

Bug #19033

closed

CVE-2017-2667 - SSL/HTTPS server certificates are not verified by default

Added by Dominic Cleal almost 7 years ago. Updated almost 7 years ago.

Status:
Closed
Priority:
Normal
Category:
Hammer core
Target version:
-
Fixed in Releases:
Found in Releases:
In Kanboard:

Description

HTTPS connections initiated by Hammer to the API server do not perform validation of the server SSL/TLS certificate, allowing for a man-in-the-middle attack against the user.

#12400 has introduced automatic certificate verification when an SSL CA is explicitly configured, but the default for HTTPS connections remains off. It could be verified against the system CA store.

Reported by Tomas Strachota to .


Related issues 1 (0 open1 closed)

Related to Hammer CLI - Bug #12400: Missing option to enable verification of the server certificate.ClosedRobert Frank11/05/2015Actions
Actions #1

Updated by Dominic Cleal almost 7 years ago

  • Related to Bug #12400: Missing option to enable verification of the server certificate. added
Actions #2

Updated by Dominic Cleal almost 7 years ago

  • Subject changed from SSL/HTTPS server certificates are not verified by default to CVE-2017-2667 - SSL/HTTPS server certificates are not verified by default
Actions #3

Updated by Tomáš Strachota almost 7 years ago

  • Status changed from New to Assigned
  • Assignee set to Tomáš Strachota
Actions #4

Updated by The Foreman Bot almost 7 years ago

  • Status changed from Assigned to Ready For Testing
  • Pull request https://github.com/theforeman/hammer-cli/pull/235 added
Actions #5

Updated by The Foreman Bot almost 7 years ago

  • Pull request https://github.com/theforeman/hammer-cli-foreman/pull/293 added
Actions #6

Updated by Anonymous almost 7 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF