High severityNVD Advisory· Published Aug 12, 2015· Updated May 6, 2026
CVE-2015-3908
CVE-2015-3908
Description
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ansiblePyPI | < 1.9.2 | 1.9.2 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- lists.opensuse.org/opensuse-updates/2015-07/msg00051.htmlnvdThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2015-08/msg00029.htmlnvdThird Party AdvisoryWEB
- www.ansible.com/securitynvdVendor AdvisoryWEB
- github.com/advisories/GHSA-w64c-pxjj-h866ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2015-3908ghsaADVISORY
- www.openwall.com/lists/oss-security/2015/07/14/4nvdMailing ListWEB
- github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2015-1.yamlghsaWEB
- lists.debian.org/debian-lts-announce/2019/09/msg00016.htmlnvdWEB
News mentions
0No linked articles in our index yet.