A flaw was found in libnbd. The client did not always correctly verify the NBD servers certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | RedHat | virt-devel:rhel-8100020240905091210.489197e6 | * |
| Red Hat Enterprise Linux 8 | RedHat | virt:rhel-8100020240905091210.489197e6 | * |
| Red Hat Enterprise Linux 9 | RedHat | libnbd-0:1.18.1-4.el9_4 | * |
| Libnbd | Ubuntu | focal | * |
| Libnbd | Ubuntu | oracular | * |