PT-2018-5191 · Matrixssl · Matrixssl

Publicado 2018-01-09 · Atualizado 2018-01-26 · CVE-2017-1000415

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MatrixSSL version 3.7.2

Description The issue is related to an incorrect UTCTime date range validation in the X.509 certificate validation process. This results in some certificates having their expiration or beginning year extended by 100 years.

Recommendations For MatrixSSL version 3.7.2, update to a version that correctly validates UTCTime date ranges in X.509 certificates to prevent incorrect certificate expiration or beginning year extensions.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-1000415

Produtos afetados

Matrixssl

Referências · 4

• https://youtube.com/watch?v=FW--c_F_cY8 · Nota
• https://ieee-security.org/TC/SP2017/papers/231.pdf · Nota
• https://osv.dev/vulnerability/CVE-2017-1000415 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000415 · Nota de Segurança