CVE-2021-34433

2021-08-2017:10:10

CWE-322

eclipse

www.cve.org

0.001 Low

EPSS

Percentile

33.0%

JSON

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side’s signature on the client side, if that signature is not included in the server’s ServerKeyExchange.

CNA Affected

[
  {
    "product": "Eclipse Californium",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.6.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "3.0.0-M1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.0.0-M3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

bugs.eclipse.org/bugs/show_bug.cgi?id=575281

0.001 Low

EPSS

Percentile

33.0%

JSON

Related for CVELIST:CVE-2021-34433