CVE-2023-32198 - Vulnerability Details - OpenCVE

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Suse	Steve

No data.

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32198
https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx

History

Mon, 19 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Suse Suse steve
Vendors & Products		Suse Suse steve

Thu, 15 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.
Title		Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
Weaknesses		CWE-295
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32198 https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2026-10-15T08:22:47.085Z

Updated: 2026-10-15T19:58:21.837Z

Reserved: 2023-05-04T08:30:59.322Z

Link: CVE-2023-32198

Vulnrichment

Updated: 2026-10-15T19:58:18.512Z

NVD

Status : Awaiting Analysis

Published: 2026-10-15T09:17:13.847

Modified: 2026-10-16T19:55:59.740

Link: CVE-2023-32198

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-32198", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2023-05-04T08:30:59.322Z", "datePublished": "2026-10-15T08:22:47.085Z", "dateUpdated": "2026-10-15T19:58:21.837Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-15T08:22:47.085Z"}, "title": "Steve doesn\u2019t verify a server\u2019s certificate and is susceptible to man-in-the-middle (MitM) attacks", "datePublic": "2025-04-25T15:12:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-295", "description": "CWE-295: Improper certificate validation", "type": "CWE"}]}], "affected": [{"vendor": "SUSE", "product": "steve", "packageName": "github.com/rancher/steve", "versions": [{"status": "affected", "version": "0.2.0", "lessThan": "0.2.1", "versionType": "semver"}, {"status": "affected", "version": "0.3.0", "lessThan": "0.3.3", "versionType": "semver"}, {"status": "affected", "version": "0.4.0", "lessThan": "0.4.4", "versionType": "semver"}, {"status": "affected", "version": "0.5.0", "lessThan": "0.5.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.</p>"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32198"}, {"url": "https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T19:58:12.590466Z", "id": "CVE-2023-32198", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T19:58:21.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T19:58:12.590466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T19:58:18.512Z"}}], "cna": {"title": "Steve doesn\u2019t verify a server\u2019s certificate and is susceptible to man-in-the-middle (MitM) attacks", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "steve", "versions": [{"status": "affected", "version": "0.2.0", "lessThan": "0.2.1", "versionType": "semver"}, {"status": "affected", "version": "0.3.0", "lessThan": "0.3.3", "versionType": "semver"}, {"status": "affected", "version": "0.4.0", "lessThan": "0.4.4", "versionType": "semver"}, {"status": "affected", "version": "0.5.0", "lessThan": "0.5.13", "versionType": "semver"}], "packageName": "github.com/rancher/steve", "defaultStatus": "unaffected"}], "datePublic": "2025-04-25T15:12:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32198"}, {"url": "https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper certificate validation"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2026-10-15T08:22:47.085Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32198", "state": "PUBLISHED", "dateUpdated": "2026-10-15T19:58:21.837Z", "dateReserved": "2023-05-04T08:30:59.322Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2026-10-15T08:22:47.085Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}