CVE-2015-1777

rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.

Score

CVSS 3.0 5.9 Medium

Status

Modified - secalert@redhat.com

Published

2018-04-12

Last modified

2024-08-06

Weaknesses

CWE-295

Affected products

• Rhn-client-tools (Redhat)

References

• http://www.openwall.com/lists/oss-security/2015/03/04/7
• http://www.securityfocus.com/bid/72943
• https://bugzilla.redhat.com/show_bug.cgi?id=1198740