Lucene search

[email protected]CVE-2021-34433

HistoryAug 20, 2021 - 5:15 p.m.

CVE-2021-34433

2021-08-2017:15:07

CWE-347

CWE-322

[email protected]

web.nvd.nist.gov

eclipse

californium

cve-2021-34433

dtls

handshake

security

vulnerability

certificate

x509

rpk

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

33.2%

JSON

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side’s signature on the client side, if that signature is not included in the server’s ServerKeyExchange.

Affected configurations

NVD

Node

eclipsecaliforniumRange2.0.0–2.6.5

eclipsecaliforniumMatch3.0.0m1

eclipsecaliforniumMatch3.0.0m2

eclipsecaliforniumMatch3.0.0m3

CPENameOperatorVersion
eclipse:californiumeclipse californiumlt2.6.5
eclipse:californiumeclipse californiumeq3.0.0

CPE	Name	Operator	Version
eclipse:californium	eclipse californium	lt	2.6.5
eclipse:californium	eclipse californium	eq	3.0.0

CNA Affected

[
  {
    "product": "Eclipse Californium",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.6.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "3.0.0-M1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.0.0-M3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

bugs.eclipse.org/bugs/show_bug.cgi?id=575281

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

33.2%

JSON

Related for CVE-2021-34433

cvelist1 osv1 nvd1 prion1