Apache Libcloud vulnerabilities

3 CVEs affecting Apache Libcloud, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-6480, published 2014-01-07.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-6480, published 2014-01-07. Low severity, CVSS 2.1. EPSS: 2.1% chance of exploitation in the next 30 days. Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
• CVE-2010-4340, published 2011-09-12. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle…
• CVE-2012-3446, published 2012-11-04. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field…