Lucene search
MitreCVELIST:CVE-2018-8970HistoryMar 24, 2018 - 9:00 p.m.
CVE-2018-8970
2018-03-2421:00:00
mitre
www.cve.org
5
The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not.
Related
nvd
nvd
CVE-2018-8970
2018-03-24 21:29:00
cve
cve
CVE-2018-8970
2018-03-24 21:29:00
prion
prion
Design/Logic Flaw
2018-03-24 21:29:00
hackerone
hackerone
osv
osv
libcrypto46-3.3.4-1.2 on GA media
2024-06-15 00:00:00
suse
suse
Security update for libressl (moderate)
2018-09-04 00:07:35
openvas
openvas
openSUSE: Security Advisory for libressl (openSUSE-SU-2018:2597-1)
2018-09-04 00:00:00
nessus
nessus
openSUSE Security Update : libressl (openSUSE-2018-953)
2018-09-04 00:00:00