libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Nov 22, 2017 | Oct 31, 2017 |
| Debian | — | Upgrade libvirt | Dec 5, 2017 | Oct 19, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 16, 2017 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-bash-completionUpgrade libvirt-daemon-hooksUpgrade libvirtUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-lock-sanlockUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-develUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-qemuUpgrade libvirt-clientUpgrade libvirt-daemon-driver-networkUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-nwfilter | Oct 25, 2017 | Oct 25, 2017 |
| Ubuntu | — | Upgrade libvirt-binUpgrade libvirt0 | Feb 21, 2018 | Oct 25, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 31, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub