CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-2667
Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-295, CWE-345
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:satellite
- redhat:satellite_capsule
- theforeman:hammer_cli
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-77h8-xr85-3x5q | RubyGems | hammer_cli_foreman | <0.10.0 | 0.10.0 |