CVE-2019-3841CWE-295

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container…

High · published March 25, 2019

CVSS v3.0
7.4
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00531 · 44.1th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2019-03-25T17:03Z
EPSS history
Timeline
  • 25 MAR 17:03Z
    Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container…
    cvelistv5