CVE-2024-7383

Description

A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.

Reserved 2024-08-01 | Published 2024-08-05 | Updated 2024-11-12 | Assigner redhat

Problem types

Improper Certificate Validation

Product status

Default status
unaffected

1.18.0 before 1.18.5
affected

1.20.0 before 1.20.2
affected

Default status
affected

8100020240905091210.489197e6 before *
unaffected

Default status
affected

8100020240905091210.489197e6 before *
unaffected

Default status
affected

0:1.18.1-4.el9_4 before *
unaffected

Default status
affected

Timeline

2024-08-04:	Reported to Red Hat.
2024-06-25:	Made public.

Credits

Red Hat would like to thank Jon Szymaniak for reporting this issue.

References

access.redhat.com/errata/RHSA-2024:6757 (RHSA-2024:6757) vendor-advisory

access.redhat.com/errata/RHSA-2024:6964 (RHSA-2024:6964) vendor-advisory

access.redhat.com/security/cve/CVE-2024-7383 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2302865 (RHBZ#2302865) issue-tracking

lists.libguestfs.org/...age/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2

lists.libguestfs.org/...ad/ENZY4LHLARA3N4C3JUNLPYUCXHFO7BWQ/

cve.org (CVE-2024-7383)

nvd.nist.gov (CVE-2024-7383)

Download JSON