Read the docs
TI-2022-02766 Aliases CVE-2022-2996GHSA-rf3f-3p37-2qh4

Improper certificate validation in python-scciclient

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.

Why it matters now

EPSS 0.00663 51st percentileScored 2026-11-07
Fix Partial python-scciclient (PyPI): 0.12.0Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—python-scciclient0.11.0—No fix listedCNA
—python-scciclient (PyPI)before 0.12.00.12.0Patch availableGHSA-rf3f-3p37-2qh4
  • python-scciclient Vendor— Affected 0.11.0 Fixed in — No fix listed CNA
  • python-scciclient (PyPI) Vendor— Affected before 0.12.0 Fixed in 0.12.0 Patch available GHSA-rf3f-3p37-2qh4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:python-scciclient_project:python-scciclient:0.11.0:*:*:*:*:python:*:*0.11.0VulnerablePython-scciclient Project
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:python-scciclient_project:python-scciclient:0.11.0:*:*:*:*:python:*:* Versions 0.11.0 Vulnerable ·Python-scciclient Project
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-rf3f-3p37-2qh4 python-scciclient (PyPI) Fixed in 0.12.0 Advisory →

Red Hat 4 advisories

  • RHSA-2023:0276 Released 2023-01-25 · Red Hat rating Moderate
    Red Hat OpenStack Platform 17.0 (python-scciclient) security update
    • Red Hat OpenStack Platform 17.0 python-scciclient-0.10.2-0.20220830130628.b8e6e34.el9ost, python3-scciclient-0.10.2-0.20220830130628.b8e6e34.el9ost
  • RHSA-2022:7398 Released 2023-01-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.0 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
    • Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
  • RHSA-2022:8868 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1.9 (python-scciclient) security update
    • Red Hat OpenStack Platform 16.1 python-scciclient-0.9.1-2.20220111031440.el8ost, python3-scciclient-0.9.1-2.20220111031440.el8ost
Show 1 more Red Hat advisories
  • RHSA-2022:8854 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2.4 (python-scciclient) security update
    • Red Hat OpenStack Platform 16.2 python-scciclient-0.9.1-2.20220111031440.el8ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Ironic content for Red Hat OpenShift Container Platform 4.12Fixed RHSA-2022:7398
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2022:7398
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:8868
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:8854
Red Hat OpenStack Platform 17.0Fixed RHSA-2023:0276
Not affected: 1 product
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2996
  2. 2026-10-03 Alias added: GHSA-rf3f-3p37-2qh4
  3. 2026-10-26 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences