Описание
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 8.10.0~dfsg-2 |
| cosmic | not-affected | 8.11.2~dfsg-1 |
| devel | not-affected | 8.11.2~dfsg-1 |
| disco | not-affected | 8.11.2~dfsg-1 |
| eoan | not-affected | 8.11.2~dfsg-1 |
| esm-apps/bionic | not-affected | 8.10.0~dfsg-2 |
| esm-apps/focal | not-affected | 8.11.2~dfsg-1 |
| esm-apps/jammy | not-affected | 8.11.2~dfsg-1 |
| esm-apps/xenial | released | 4.2.6~dfsg-1ubuntu4.2+esm1 |
Показывать по
EPSS
4.3 Medium
CVSS2
5.9 Medium
CVSS3
Связанные уязвимости
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, ...
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
EPSS
4.3 Medium
CVSS2
5.9 Medium
CVSS3