Lucene search
GoogleOSV:GHSA-CMXJ-WX9V-52QRHistoryMay 14, 2022 - 3:59 a.m.
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
2022-05-1403:59:54
Google
osv.dev
33
0.001 Low
EPSS
Percentile
42.3%
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject’s Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ca.juliusdavies:not-yet-commons-ssl | eq | 0.3.11 | |
| ca.juliusdavies:not-yet-commons-ssl | eq | 0.3.9 |
References
juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172
rhn.redhat.com/errata/RHSA-2015-1888.html
bugzilla.redhat.com/show_bug.cgi?id=1131803
exchange.xforce.ibmcloud.com/vulnerabilities/97659
github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml
nvd.nist.gov/vuln/detail/CVE-2014-3604
Related
securityvulns
securityvulns
Not Yet Commons SSL certificate spoofing
2015-04-19 00:00:00
[ MDVSA-2015:141 ] not-yet-commons-ssl
2015-04-19 00:00:00
cvelist
cvelist
CVE-2014-3604
2014-10-25 00:00:00
cve
cve
CVE-2014-3604
2014-10-25 00:55:03
ubuntucve
ubuntucve
CVE-2014-3604
2014-10-25 00:00:00
nessus
nessus
Mandriva Linux Security Advisory : not-yet-commons-ssl (MDVSA-2015:141)
2015-03-30 00:00:00
Fedora 19 : not-yet-commons-ssl-0.3.15-2.fc19 (2014-10746)
2014-09-26 00:00:00
Fedora 21 : not-yet-commons-ssl-0.3.15-2.fc21 (2014-10691)
2014-09-23 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: not-yet-commons-ssl-0.3.15-2.fc19
2014-09-25 10:37:48
[SECURITY] Fedora 20 Update: not-yet-commons-ssl-0.3.15-2.fc20
2014-09-25 10:32:42
[SECURITY] Fedora 21 Update: not-yet-commons-ssl-0.3.15-2.fc21
2014-09-23 05:10:13
debiancve
debiancve
CVE-2014-3604
2014-10-25 00:55:00
openvas
openvas
Fedora Update for not-yet-commons-ssl FEDORA-2014-10746
2014-10-01 00:00:00
Fedora Update for not-yet-commons-ssl FEDORA-2014-10729
2014-10-01 00:00:00
Mageia: Security Advisory (MGASA-2014-0551)
2022-01-28 00:00:00
github
github
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
2022-05-14 03:59:54
gitlab
gitlab
Cryptographic Issues
2014-10-24 00:00:00
prion
prion
Design/Logic Flaw
2014-10-25 00:55:00
nvd
nvd
CVE-2014-3604
2014-10-25 00:55:03
mageia
mageia
Updated not-yet-commons-ssl packages fix CVE-2014-3604
2014-12-26 20:04:58
redhat
redhat
(RHSA-2015:1888) Important: Red Hat JBoss SOA Platform 5.3.1 security update
2015-10-12 15:22:52
