serf vulnerability

2014-08-1400:00:00

ubuntu.com

7.7 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

30.7%

JSON

Releases

Ubuntu 14.04 ESM
Ubuntu 12.04

Packages

serf - high-performance asynchronous HTTP client library

Details

Ben Reser discovered that serf did not correctly handle SSL certificates
with NUL bytes in the CommonName or SubjectAltNames fields. A remote
attacker could exploit this to perform a machine-in-the-middle attack to view
sensitive information or alter encrypted communications.

OSVersionArchitecturePackageVersionFilename
Ubuntu14.04noarchlibserf-1-1< 1.3.3-1ubuntu0.1UNKNOWN
Ubuntu14.04noarchlibserf-dev< 1.3.3-1ubuntu0.1UNKNOWN
Ubuntu14.04noarchlibserf1-dbg< 1.3.3-1ubuntu0.1UNKNOWN
Ubuntu12.04noarchlibserf1< 1.0.0-2ubuntu0.1UNKNOWN
Ubuntu12.04noarchlibserf-dev< 1.0.0-2ubuntu0.1UNKNOWN
Ubuntu12.04noarchlibserf1-dbg< 1.0.0-2ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	14.04	noarch	libserf-1-1	< 1.3.3-1ubuntu0.1	UNKNOWN
Ubuntu	14.04	noarch	libserf-dev	< 1.3.3-1ubuntu0.1	UNKNOWN
Ubuntu	14.04	noarch	libserf1-dbg	< 1.3.3-1ubuntu0.1	UNKNOWN
Ubuntu	12.04	noarch	libserf1	< 1.0.0-2ubuntu0.1	UNKNOWN
Ubuntu	12.04	noarch	libserf-dev	< 1.0.0-2ubuntu0.1	UNKNOWN
Ubuntu	12.04	noarch	libserf1-dbg	< 1.0.0-2ubuntu0.1	UNKNOWN