CVE-2023-32198 PUBLISHED

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks

Assigner: suse
Reserved: 04.05.2023 Published: 15.10.2026 Updated: 15.10.2026

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	SUSE
Product	steve
Versions	Default: unaffected affected from 0.2.0 to 0.2.1 (excl.) affected from 0.3.0 to 0.3.3 (excl.) affected from 0.4.0 to 0.4.4 (excl.) affected from 0.5.0 to 0.5.13 (excl.)

References

Problem Types

CWE-295: Improper certificate validation CWE