CVE

Id
52230  
CVE No.
CVE-2011-4318  
Status
Candidate  
Description
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject"s Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.  
Phase
Assigned (20111104)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
558097 52230 CVE-2011-4318 MLIST:[dovecot-news] 20111117 v2.0.16 released  View
558098 52230 CVE-2011-4318 URL:http://www.dovecot.org/list/dovecot-news/2011-November/000200.html  View
558099 52230 CVE-2011-4318 MLIST:[oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate"s CN against requested remote server hostname when proxying  View
558100 52230 CVE-2011-4318 URL:http://www.openwall.com/lists/oss-security/2011/11/18/5  View
558101 52230 CVE-2011-4318 MLIST:[oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate"s CN against requested remote server hostname when proxying  View
558102 52230 CVE-2011-4318 URL:http://www.openwall.com/lists/oss-security/2011/11/18/7  View
558103 52230 CVE-2011-4318 MISC:https://bugs.gentoo.org/show_bug.cgi?id=390887  View
558104 52230 CVE-2011-4318 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=754980  View
558105 52230 CVE-2011-4318 CONFIRM:http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1  View
558106 52230 CVE-2011-4318 REDHAT:RHSA-2013:0520  View
558107 52230 CVE-2011-4318 URL:http://rhn.redhat.com/errata/RHSA-2013-0520.html  View
558108 52230 CVE-2011-4318 SECUNIA:46886  View
558109 52230 CVE-2011-4318 URL:http://secunia.com/advisories/46886  View
558110 52230 CVE-2011-4318 SECUNIA:52311  View

Related JVN