CVE

Id
59057  
CVE No.
CVE-2012-5814  
Status
Candidate  
Description
Weberknecht, as used in GitHub Gaug.es and other products, does not verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.  
Phase
Assigned (20121104)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
602797 59057 CVE-2012-5814 MISC:http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf  View
602798 59057 CVE-2012-5814 XF:weberknecht-ssl-spoofing(79937)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
29544 JVNDB-2012-005251 FilesAnywhere における SSL サーバを偽装される脆弱性 FilesAnywhere は、サーバホスト名と X.509 証明書上の subject の Common Name (CN) または subjectAltName フィールドのドメイン名を照合しないため、SSL サーバを偽装される脆弱性が存在します。 CVE-2012-5819 59057 5.8 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005251.html  View