CVE-2017-2639

7.5 highEPSS 1.1%

It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2018-07-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:cloudforms
redhat:cloudforms_management_engine

References

http://www.securityfocus.com/bid/98769
http://www.securitytracker.com/id/1038599
https://access.redhat.com/errata/RHSA-2017:1367
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2639
http://www.securityfocus.com/bid/98769

Check your stack JSON