VYPR
← All advisories
High severityNVD Advisory· Published Sep 12, 2011· Updated Apr 29, 2026

CVE-2010-4340

CVE-2010-4340

Description

libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
apache-libcloudPyPI
< 0.4.00.4.0

Affected products

4
  • Apache/Libcloud4 versions
    cpe:2.3:a:apache:libcloud:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:libcloud:*:*:*:*:*:*:*:*range: <=0.4.0
    • cpe:2.3:a:apache:libcloud:0.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:libcloud:0.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:libcloud:0.3.1:*:*:*:*:*:*:*

Patches

1
87ee61e6ba03

LIBCLOUD-55: Add warnings and a link to Python bug tracker

https://github.com/apache/libcloudJedidiah SmithSep 29, 2010via ghsa
commit
2 files changed · +15 −1
  • libcloud/base.py+8 −0 modified
    @@ -307,6 +307,14 @@ class ConnectionKey(object):
     """
     A Base Connection class to derive from.
     """
+
+    # WARNING: Python's built-in SSL does not do certificate validation.  As
+    # such, one cannot be sure of the other end of the conversation with any
+    # sufficient authority.  If you are in a position to be exploited (i.e., on
+    # an untrusted network), be cautious with SSL connections.  This is an issue
+    # with upstream Python (see http://bugs.python.org/issue1589 for details)
+    # and not with libcloud.
+
     #conn_classes = (httplib.LoggingHTTPConnection, LoggingHTTPSConnection)
     conn_classes = (httplib.HTTPConnection, httplib.HTTPSConnection)
  • README+7 −1 modified
    @@ -7,4 +7,10 @@ Apache libcloud is an incubator project at the Apache Software Foundation, see
 <http://incubator.apache.org/libcloud> for more information.
 
 For API documentation and examples, see:
-  <http://incubator.apache.org/libcloud/getting-started.html>
\ No newline at end of file
+  <http://incubator.apache.org/libcloud/getting-started.html>
+
+WARNING: Python's built-in SSL does not do certificate validation.  As such, one
+cannot be sure of the other end of the conversation with any sufficient
+authority.  If you are in a position to be exploited (i.e., on an untrusted
+network), be cautious with SSL connections.  This is an issue with upstream
+Python (see http://bugs.python.org/issue1589 for details) and not with libcloud.

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.