Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN755
_____________________________________________________________________


DATE                : 16/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): All Xen versions from at least 3.2 onwards.
 
=====================================================================

https://xenbits.xen.org/xsa/advisory-498.html
_____________________________________________________________________



            Xen Security Advisory CVE-2026-42491 / XSA-498
                               version 2

              XAPI: Missing TLS verification in some SDKs

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

XAPI provides SDKs; bindings for the API in various programming
languages.  These are artefacts from a build of XAPI, intended for
integration into 3rd party products.

In all SDKs, there is a main RPC connection to the XAPI host.  TLS for
this connection is verified properly, or delegated to the 3rd party
logic, in all language bindings.

There are also certain HTTP handlers which open a separate connection
to the XAPI host.  For two of the language bindings only (C# and
Powershell), TLS verification is improperly implemented on these
connections.

IMPACT
======

A malicious actor able to perform a Man-in-the-Middle attack on the
network communication between a program using one of the affected
SDKs and a host running XAPI may be able to intercept the
communication and:

 * Steal a session token, allowing for hijack of the administrative
   session, or
 * Read or tamper with exported/imported disk images, host backups,
   RRD (performance) data and patches/updates in transit.

VULNERABLE SYSTEMS
==================

This issues has been present in the XAPI C# and Powershell SDKs since
TLS support was added.

MITIGATION
==========

There are no known mitigations.

CREDITS
=======

This issue was discovered by the Veeam Team.

RESOLUTION
==========

Applying the attached patch to XAPI master will generate fixed SDKs.
3rd party programs using vulnerable SDKs must be rebuilt against the
fixed SDKs.

xsa498.patch           XAPI master

$ sha256sum xsa498*
f2db9e16561edc59b920e0ed95cce3a19147abc6eb2b8500bd73b87dc285d4ba  xsa498.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.


(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================