PT-2014-3592 · Ignite Realtime · Smack Xmpp Api

Florian Schmaus + 1 · Published 2014-04-30 · Updated 2021-02-23 · CVE-2014-0363

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Smack XMPP API versions prior to 4.0.0-rc1

Description The issue concerns the ServerTrustManager component, which fails to verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers. This allows attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

Recommendations For versions prior to 4.0.0-rc1, update to version 4.0.0-rc1 or later to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2014-0363

MGASA-2014-0548

Affected Products

Smack Xmpp Api

References · 13

• http://issues.igniterealtime.org/browse/SMACK-410 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0548.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146206.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0548 · Vendor Advisory
• http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-released · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137233.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1176.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0363 · Security Note
• http://secunia.com/advisories/59290 · Note
• http://kb.cert.org/vuls/id/489228 · Note
• https://bugs.mageia.org/show_bug.cgi?id=14040 · Note
• http://secunia.com/advisories/59291 · Note
• http://securityfocus.com/bid/67119 · Note