CVE-2017-2667

CVE-2017-2667 describes a critical vulnerability in Hammer CLI, a command-line utility for Foreman, affecting versions prior to 0.10.0, as well as Red Hat Satellite and TheForeman Satellite products. The flaw stems from the Hammer CLI's failure to explicitly set the verify_ssl flag for apipie-bindings, leading to disabled server certificate verification. This oversight makes connections susceptible to man-in-the-middle (MitM) attacks, allowing attackers to intercept and potentially manipulate communication. Rated with a CVSS score of 8.1 (HIGH), this vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, despite a high attack complexity. The lack of proper SSL verification allows an attacker to impersonate legitimate servers, compromising data and system integrity. Currently, there is no evidence of active exploitation, nor is exploit code available in Metasploit, Nuclei, or ExploitDB. The CVE has also received minimal community discussion and media coverage, suggesting a low level of public awareness or immediate threat.