CVE-2017-1000256

HIGH8.1EPSS 0.77%

libvirt - security update

Published: 10/31/2017Modified: 11/19/2025

Also known as:ALPINE-CVE-2017-1000256DEBIAN-CVE-2017-1000256

Description

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

Affected packages (3)

Alpine/libvirtfrom 0, < 2.5.0-r2
Debian/libvirtfrom 0, < 3.8.0-3
Debian/libvirtfrom 0, < 3.0.0-4+deb9u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2017-1000256
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-1000256