GitHub Advisory DatabaseGHSA-CMXJ-WX9V-52QRImproper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.7%
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject’s Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ca.juliusdavies:not-yet-commons-ssl | lt | 0.3.15 |
References
juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172
rhn.redhat.com/errata/RHSA-2015-1888.html
bugzilla.redhat.com/show_bug.cgi?id=1131803
exchange.xforce.ibmcloud.com/vulnerabilities/97659
github.com/advisories/GHSA-cmxj-wx9v-52qr
github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml
nvd.nist.gov/vuln/detail/CVE-2014-3604
Related
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
41.7%