CVE-2017-1000209

2017-11-1702:29:01

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.8%

JSON

The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.

CPENameOperatorVersion
nv-websocket-clienteqnv-websocket-client-2.0
nv-websocket-clienteqnv-websocket-client-1.31
nv-websocket-clienteqnv-websocket-client-1.3
nv-websocket-clienteqnv-websocket-client-1.22
nv-websocket-clienteqnv-websocket-client-1.24
nv-websocket-clienteqnv-websocket-client-1.27
nv-websocket-clienteqnv-websocket-client-1.6
nv-websocket-clienteqnv-websocket-client-1.15
nv-websocket-clienteqnv-websocket-client-1.19
nv-websocket-clienteqnv-websocket-client-1.26

Name	Operator	Version
nv-websocket-client	eq	nv-websocket-client-2.0
nv-websocket-client	eq	nv-websocket-client-1.31
nv-websocket-client	eq	nv-websocket-client-1.3
nv-websocket-client	eq	nv-websocket-client-1.22
nv-websocket-client	eq	nv-websocket-client-1.24
nv-websocket-client	eq	nv-websocket-client-1.27
nv-websocket-client	eq	nv-websocket-client-1.6
nv-websocket-client	eq	nv-websocket-client-1.15
nv-websocket-client	eq	nv-websocket-client-1.19
nv-websocket-client	eq	nv-websocket-client-1.26