CVE-2012-0861: Red Hat Enterprise Virtualization Manager

Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days.

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

Affected products

• Red Hat Enterprise Virtualization Manager: up to and including 3.0; version 2.1 only; version 2.2 only; version 2.2.3 only

Published 2013-01-04. Last modified 2026-06-16.