Key points
- SUSE Steve versions before 0.2.1, 0.3.3, 0.4.4, and 0.5.13 are affected.
- The vulnerability allows execution of man-in-the-middle attacks against services.
- The issue stems from a default insecure option that skips certificate validation.
SUSE Steve contains a vulnerability that permits man-in-the-middle attacks against services using the software. The flaw exists because the product defaults to an insecure configuration that fails to validate remote server certificates during TLS connections.
What happened
A vulnerability has been identified in SUSE Steve regarding its handling of Transport Layer Security connections. According to the National Vulnerability Database record for CVE-2023-32198, the software used an insecure option by default. This configuration failed to validate the certificate presented by the remote server during the connection process.
The weakness is classified under CWE-295, which relates to improper verification of cryptographic information. The NVD rates the severity of this flaw as high. The issue allows for the execution of man-in-the-middle attacks against services that rely on Steve for communication. This means an attacker could potentially intercept or modify data if they position themselves between the client and server.
Why it matters
Organisations using affected versions of SUSE Steve face a direct risk to their data integrity and confidentiality. The lack of certificate validation undermines the fundamental purpose of TLS encryption. Attackers can exploit this default setting to impersonate legitimate servers. This could lead to the interception of sensitive information transmitted over the network.
The vulnerability is present in multiple version branches of the software. Specifically, versions before 0.2.1, before 0.3.3, before 0.4.4, and before 0.5.13 are confirmed to be affected. Teams must verify their current installation against this list. The high severity rating indicates a significant potential for exploitation in typical deployment scenarios.
What happens next
- Identify all instances of SUSE Steve within the infrastructure.
- Check the installed version against the affected list.
- Upgrade to version 0.2.1, 0.3.3, 0.4.4, or 0.5.13 or later.
- Verify that TLS certificate validation is now active.
Patch priority
Teams should prioritise updating systems that handle sensitive data or face the public internet. Exposure assessment must come first to determine which instances are visible to potential attackers. Roll out the fix in stages, starting with the most critical services. Test the update in a non-production environment to ensure compatibility. Back up configurations before applying changes. If immediate patching is not possible, consider isolating affected services from untrusted networks. Monitor logs for unusual connection patterns that might indicate active exploitation. Ensure that all future deployments enforce strict certificate validation by default.
What to do and how to stay safe: SUSE
- Audit your SUSE Steve installations to determine the current version numbers.
- Update affected systems to the latest patched version provided by the vendor.
- Review TLS configurations to ensure certificate validation is enforced.
- Monitor network traffic for signs of man-in-the-middle activity.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2023-32198?
The National Vulnerability Database rates the severity as high with a score of 8.
Which versions of SUSE Steve are not affected?
Versions 0.2.1, 0.3.3, 0.4.4, and 0.5.13 or later are not affected.
What type of attack does this vulnerability allow?
It allows for the execution of man-in-the-middle attacks against services.
