CVE-2010-4340
Apache Libcloud does not verify SSL certificates for HTTPS connections
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
Exploit likelihood
What each source reports
NVD Score used
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
- Record
CVE-2010-4340- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
- Record
CVE-2010-4340- Updated
- 2026-11-02
EUVDEUVD-2011-0001 No score
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
- Record
EUVD-2011-0001- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w3j6-8j34-q43x
Apache Libcloud does not verify SSL certificates for HTTPS connections
libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.
- Record
GHSA-w3j6-8j34-q43x- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-w3j6-8j34-q43x
Apache Libcloud does not verify SSL certificates for HTTPS connections
libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.
- Record
GHSA-w3j6-8j34-q43x- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV No score
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
- Record
CVE-2010-4340- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4340 No score
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
- Record
DEBIAN-CVE-2010-4340- Updated
- 2026-11-02
OSVPYSEC-2011-24 No score
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.
- Record
PYSEC-2011-24- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-libcloudPyPI |
before 0.4.0 | 0.4.0 |
libcloudDebian:12 |
before 0.5.0-1 | 0.5.0-1 |
libcloudDebian:13 |
before 0.5.0-1 | 0.5.0-1 |
libcloudDebian:14 |
before 0.5.0-1 | 0.5.0-1 |
apache-libcloudPyPI |
before 0.4.0, plus listed versions 0.3.1 |
0.4.0 |
apache-libcloudPyPI |
before 0.4.2, plus listed versions 0.3.10.4.0 |
0.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4340 is a medium vulnerability (CVSS 4.3) in Apache Libcloud, published September 11, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in apache-libcloud 0.4.0.
References
mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira%40thor%3E
wiki.apache.org/incubator/LibcloudSSL
bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463
issues.apache.org/jira/browse/LIBCLOUD-55
nvd.nist.gov/vuln/detail/CVE-2010-4340
Show 7 moreShow less
github.com/apache/libcloud/commit/87ee61e6ba03a43dcefea2ce180988bec066b6fd
bugs.python.org/issue1589
security-tracker.debian.org/tracker/CVE-2010-4340