Every CVE Search/ Get API key

CVE-2012-0861

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a...

6.8 MediumFix available

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

Exploit likelihood

0.90%Down 0.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

Record
CVE-2012-0861
CVSS 2.0
6.8 MediumAV:A/AC:H/Au:N/C:C/I:C/A:C
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

Record
CVE-2012-0861
Updated
2026-11-02
EUVDEUVD-2012-0886 No score

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

Record
EUVD-2012-0886
Updated
2026-11-03
GitHub AdvisoriesGHSA-9gfq-v95v-9hrx No score

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a...

The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.

Record
GHSA-9gfq-v95v-9hrx
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
 before 0:6.3-20121121.0.el6_3
0:6.3-20121121.0.el6_3
rhevm
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-backend
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-config
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-dbscripts
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-genericapi
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-notification-service
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-restapi
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-setup
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-setup-plugin-allinone
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
Show 9 moreShow less
Affected packages
PackageAffectedFixed
rhevm-tools-common
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-userportal
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
rhevm-webadmin-portal
Red Hat:rhev_manager:3
 before 0:3.1.0-32.el6ev
0:3.1.0-32.el6ev
vdsm
Red Hat:enterprise_linux:6::hypervisor
 before 0:4.9.6-44.0.el6_3
0:4.9.6-44.0.el6_3
vdsm-cli
Red Hat:enterprise_linux:6::hypervisor
 before 0:4.9.6-44.0.el6_3
0:4.9.6-44.0.el6_3
vdsm-debuginfo
Red Hat:enterprise_linux:6::hypervisor
 before 0:4.9.6-44.0.el6_3
0:4.9.6-44.0.el6_3
vdsm-hook-vhostmd
Red Hat:enterprise_linux:6::hypervisor
 before 0:4.9.6-44.0.el6_3
0:4.9.6-44.0.el6_3
vdsm-python
Red Hat:enterprise_linux:6::hypervisor
 before 0:4.9.6-44.0.el6_3
0:4.9.6-44.0.el6_3
vdsm-reg
Red Hat:enterprise_linux:6::hypervisor
 before 0:4.9.6-44.0.el6_3
0:4.9.6-44.0.el6_3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0861 is a medium vulnerability (CVSS 6.8) in Redhat Enterprise Virtualization Manager, published January 4, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in rhev-hypervisor6 0:6.3-20121121.0.el6_3.

References

Show 179 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open