PT-2019-15544 · European Commission · Eidas-Node Integration Package

Published 2019-10-30 · Updated 2019-11-05 · CVE-2019-18633

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions European Commission eIDAS-Node Integration Package versions prior to 2.3.1

Description The issue is related to Missing Certificate Validation. This occurs because a certain ExplicitKeyTrustEvaluator return value is not checked, which can lead to security problems. It is confirmed that version 2.1 is affected.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-18633

Affected Products

Eidas-Node Integration Package

References · 3

• 🔥 https://sec-consult.com/en/blog/advisories/15587 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18633 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18633 · Vendor Advisory