PT-2014-5415 · Not Yet Commons · Not Yet Commons Ssl

Published 2014-10-25 · Updated 2022-05-14 · CVE-2014-3604

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Not Yet Commons SSL versions prior to 0.3.15

Description The issue arises from improper verification of the server hostname against the domain name in the subject's Common Name (CN) field of the X.509 certificate in the Certificates.java file. This allows man-in-the-middle attackers to spoof SSL servers using any valid certificate.

Recommendations For versions prior to 0.3.15, update to version 0.3.15 or later to resolve the issue. As a temporary workaround, consider implementing additional verification measures for server hostnames against the CN field of X.509 certificates to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-297

CWE-310

Related Identifiers

CVE-2014-3604

GHSA-CMXJ-WX9V-52QR

MGASA-2014-0551

Affected Products

Not Yet Commons Ssl

References · 15

• 🔥 https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml · Exploit
• http://juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-3604 · Security Note
• https://ubuntu.com/security/CVE-2014-3604 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1888.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cmxj-wx9v-52qr · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0551.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3604 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3604 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0551 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/138550.html · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=14175 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1131803 · Note
• http://lists.juliusdavies.ca/pipermail/not-yet-commons-ssl-juliusdavies.ca/2014-August/000832.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97659 · Note