PT-2019-15544 · European Commission · Eidas-Node Integration Package

Publicado 2019-10-30 · Atualizado 2019-11-05 · CVE-2019-18633

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions European Commission eIDAS-Node Integration Package versions prior to 2.3.1

Description The issue is related to Missing Certificate Validation. This occurs because a certain ExplicitKeyTrustEvaluator return value is not checked, which can lead to security problems. It is confirmed that version 2.1 is affected.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-18633

Produtos afetados

Eidas-Node Integration Package

Referências · 3

• 🔥 https://sec-consult.com/en/blog/advisories/15587 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18633 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-18633 · Aviso do Fabricante