Description
A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libnbd
Default version status: unaffected
1.18.0 to < 1.18.5affected1.20.0 to < 1.20.2affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
8100020240905091210.489197e6 to < *unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
8100020240905091210.489197e6 to < *unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
0:1.18.1-4.el9_4 to < *unaffected
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
Red Hat Red Hat Enterprise Linux 8 Advanced Virtualization
Default version status: affected
References
- https://access.redhat.com/errata/RHSA-2024:6757 ↗
- https://access.redhat.com/errata/RHSA-2024:6964 ↗
- https://access.redhat.com/security/cve/CVE-2024-7383 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2302865 ↗
- https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2 ↗
- https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/ENZY4LHLARA3N4C3JUNLPYUCXHFO7BWQ/ ↗