Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2023-32198

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE steve

Default version status: unaffected

  • 0.2.0 to < 0.2.1affected
  • 0.3.0 to < 0.3.3affected
  • 0.4.0 to < 0.4.4affected
  • 0.5.0 to < 0.5.13affected

References