PT-2014-5366 · Apache+2 · Serf+2
Publicado
2014-08-12
·
Atualizado
2024-06-15
·
CVE-2014-3504
CVSS v2.0
4.0
Média
| Vetor | AV:N/AC:H/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Serf versions 0.2.0 through 1.3.x before 1.3.7
Description
The issue arises from the improper handling of a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate by the
serf ssl cert issuer, serf ssl cert subject, and serf ssl cert certificate functions. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.Recommendations
For Serf versions 0.2.0 through 1.3.x before 1.3.7, update to version 1.3.7 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
serf ssl cert issuer, serf ssl cert subject, and serf ssl cert certificate functions until a patch is available.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Serf
Ubuntu