CVE-2021-34433

2021-08-2017:15:07

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.0%

JSON

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side’s signature on the client side, if that signature is not included in the server’s ServerKeyExchange.

CPENameOperatorVersion
californiumeq2.2.0
californiumeq2.3.0
californiumeq2.6.3
californiumeq2.1.0
californiumeq2.2.0-RC1
californiumeq2.1.0-RC2
californiumeq2.3.0-RC1
californiumeq2.1.0-RC1
californiumeq2.0.0
californiumeq2.4.0

Name	Operator	Version
californium	eq	2.2.0
californium	eq	2.3.0
californium	eq	2.6.3
californium	eq	2.1.0
californium	eq	2.2.0-RC1
californium	eq	2.1.0-RC2
californium	eq	2.3.0-RC1
californium	eq	2.1.0-RC1
californium	eq	2.0.0
californium	eq	2.4.0

Rows per page:

1-10 of 161

References

bugs.eclipse.org/bugs/show_bug.cgi?id=575281