{"id":"EUVD-2023-60719","enisaUuid":"a60514f7-9124-36ba-9400-212045b40d29","description":"A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.","datePublished":"Oct 15, 2026, 8:22:47 AM","dateUpdated":"Oct 15, 2026, 7:58:21 PM","baseScore":8.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2023-32198\nhttps://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx\n","aliases":"CVE-2023-32198\nGHSA-95fc-g4gj-mqmx\n","assigner":"suse","epss":0.33,"enisaIdProduct":[{"id":"13ac5027-8bf4-3cea-860c-1f59a7368433","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.4.0 \u003c0.4.4"},{"id":"2b3b79c7-e0f5-38a9-95c8-5b6149fb4d68","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.3.0 \u003c0.3.3"},{"id":"4d0e24e5-8c21-31ed-9e1c-a8fa771e134b","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.2.0 \u003c0.2.1"},{"id":"884ed826-ba13-399a-b9ed-ad5e907a1300","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.5.0 \u003c0.5.13"}],"enisaIdVendor":[{"id":"0b9e1489-44a1-30fb-9340-b071460b802d","vendor":{"name":"SUSE"}}],"enisaIdVulnerability":[{"id":"adc50b27-0bf4-3272-83c1-60b26a384027","vulnerability":{"id":"GHSA-95fc-g4gj-mqmx","description":"Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks","datePublished":"Apr 25, 2025, 3:12:44 PM","dateUpdated":"May 5, 2025, 10:02:01 PM","baseScore":0.0,"references":"https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx\nhttps://github.com/rancher/steve\nhttps://pkg.go.dev/vuln/GO-2025-3648\n","enisa_id":"EUVD-2023-60719\n","aliases":"CVE-2023-32198\nGHSA-95fc-g4gj-mqmx\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:11:42 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e0a013ec-38e3-3ba6-a4c5-99085f4325bd","vulnerability":{"id":"CVE-2023-32198","description":"A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.","datePublished":"Oct 15, 2026, 8:22:47 AM","dateUpdated":"Oct 15, 2026, 7:58:21 PM","status":"PUBLISHED","baseScore":8.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","references":"https://bugzilla.suse.com/show_bug.cgi?id\u003dCVE-2023-32198\nhttps://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx\n","enisa_id":"EUVD-2023-60719\n","assigner":"suse","epss":0.33,"dataProcessed":"Oct 28, 2026, 7:16:10 AM","vulnerabilityProduct":[{"id":"03d21a1a-d46a-3004-9016-47d1fe67a633","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.3.0 \u003c0.3.3"},{"id":"907dc1d9-1b9e-3193-898d-f1e408477fbe","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.2.0 \u003c0.2.1"},{"id":"9638bb00-562e-3352-acec-572b4c561144","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.5.0 \u003c0.5.13"},{"id":"a2f40c99-a904-3e35-82fd-aa7f25c7e91d","product":{"name":"steve","vendor":{"name":"steve-community"}},"product_version":"0.4.0 \u003c0.4.4"}],"vulnerabilityVendor":[{"id":"9a88440f-fd91-3aa6-bc69-331ee6d3bcfb","vendor":{"name":"SUSE"}}]}}],"enisaIdAdvisory":[{"id":"f6a1da3b-7634-35e4-9c21-0094a7d96f51","advisory":{"id":"openSUSE-SU-2025:15059-1","description":"govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media","datePublished":"May 7, 2025, 12:00:00 AM","dateUpdated":"Oct 18, 2026, 10:26:24 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15059-1.json\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7/\nhttps://www.suse.com/security/cve/CVE-2019-11243/\nhttps://www.suse.com/security/cve/CVE-2023-32198/\nhttps://www.suse.com/security/cve/CVE-2024-22031/\nhttps://www.suse.com/security/cve/CVE-2025-23390/\nhttps://www.suse.com/security/cve/CVE-2025-32777/\nhttps://www.suse.com/security/cve/CVE-2025-3879/\nhttps://www.suse.com/security/cve/CVE-2025-4166/\nhttps://www.suse.com/security/cve/CVE-2025-4210/\nhttps://www.suse.com/security/cve/CVE-2025-46327/\nhttps://www.suse.com/security/cve/CVE-2025-46342/\nhttps://www.suse.com/security/cve/CVE-2025-46569/\nhttps://www.suse.com/security/cve/CVE-2025-46599/\n","aliases":"CVE-2019-11243\nCVE-2023-32198\nCVE-2024-22031\nCVE-2025-23390\nCVE-2025-32777\nCVE-2025-3879\nCVE-2025-4166\nCVE-2025-4210\nCVE-2025-46327\nCVE-2025-46342\nCVE-2025-46569\nCVE-2025-46599\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0e05f718-ad99-371d-aa00-a5ad76b3cee6","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"3839ae30-44f1-3456-a197-a14fd52d4d02","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"68a9ceca-58a6-31fa-8e3c-719939718db0","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6a4e45e6-b90a-3ec6-8f91-4864558e8864","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8fbc1432-35ea-3d64-8822-a14545058c65","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"953591f6-d69a-369c-a6de-f379a9b9c770","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b8e05493-1775-36ab-85bd-2ed31ca6ad69","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c3c7f273-c243-3743-9721-c4372d6d222b","product":{"name":"govulncheck-vulndb-0:0.0.20250506T153719-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"eb786e11-5a82-36a1-85e1-81693120f50d","product":{"name":"govulncheck-vulndb-0.0.20250506T153719-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}