CVE-2011-5239

CVE-2011-5239 affects CiviCRM 4.0.5 and 4.1.1; the issue is that the server hostname is not verified against the domain in the certificate’s CN or subjectAltName. This allows man-in-the-middle attackers to spoof SSL servers using an arbitrary valid certificate. Publicly available references in th...