CVE-2014-0363

Опубликовано: 30 апр. 2014

Источник: nvd

CVSS2: 5.8

EPSS Низкий

Описание

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

Ссылки

http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released
Vendor Advisory
http://issues.igniterealtime.org/browse/SMACK-410
Issue Tracking
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1176.html
Third Party Advisory
http://secunia.com/advisories/59290
Third Party Advisory
http://secunia.com/advisories/59291
Third Party Advisory
http://www.kb.cert.org/vuls/id/489228
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/67119
Third Party Advisory
VDB Entry
http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released
Vendor Advisory
http://issues.igniterealtime.org/browse/SMACK-410
Issue Tracking
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1176.html
Third Party Advisory
http://secunia.com/advisories/59290
Third Party Advisory
http://secunia.com/advisories/59291
Third Party Advisory
http://www.kb.cert.org/vuls/id/489228
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/67119
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:igniterealtime:smack:*:*:*:*:*:*:*:*

Версия до 4.0.0 (исключая)

EPSS

Процентиль: 73%

0.00786

Низкий

5.8 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

CVE-2014-0363

redhat

около 13 лет назад

GHSA-444r-2xr3-rxhv

github

больше 3 лет назад