PT-2014-5366 · Apache+2 · Serf+2

Published 2014-08-12 · Updated 2024-06-15 · CVE-2014-3504

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Serf versions 0.2.0 through 1.3.x before 1.3.7

Description The issue arises from the improper handling of a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate by the serf ssl cert issuer, serf ssl cert subject, and serf ssl cert certificate functions. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For Serf versions 0.2.0 through 1.3.x before 1.3.7, update to version 1.3.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the serf ssl cert issuer, serf ssl cert subject, and serf ssl cert certificate functions until a patch is available.

Fix

Related Identifiers

ALT-PU-2015-1708

CVE-2014-3504

MGASA-2014-0353

OPENSUSE-SU-2024:10569-1

USN-2315-1

Affected Products

Alt Linux

Serf

Ubuntu

References · 46

• https://bdu.fstec.ru/vul/2015-00404 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3580 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10569-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1708 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1968 · Security Note
• https://osv.dev/vulnerability/CVE-2014-3504 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1847 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-3504 · Vendor Advisory
• https://security.gentoo.org/glsa/201610-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3504 · Security Note