PT-2014-3592 · Ignite Realtime · Smack Xmpp Api

Florian Schmaus + 1 · Publicado 2014-04-30 · Atualizado 2021-02-23 · CVE-2014-0363

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Smack XMPP API versions prior to 4.0.0-rc1

Description The issue concerns the ServerTrustManager component, which fails to verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers. This allows attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

Recommendations For versions prior to 4.0.0-rc1, update to version 4.0.0-rc1 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2014-0363

MGASA-2014-0548

Produtos afetados

Smack Xmpp Api

Referências · 13

• http://secunia.com/advisories/59290 · Nota
• http://kb.cert.org/vuls/id/489228 · Nota
• http://issues.igniterealtime.org/browse/SMACK-410 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=14040 · Nota
• https://advisories.mageia.org/MGASA-2014-0548.html · Nota de Segurança
• http://secunia.com/advisories/59291 · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146206.html · Aviso do Fabricante
• http://securityfocus.com/bid/67119 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0548 · Aviso do Fabricante
• http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137233.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1176.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0363 · Nota de Segurança