CVE

Id
70900  
CVE No.
CVE-2014-3604  
Status
Candidate  
Description
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject"s Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.  
Phase
Assigned (20140514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
675374 70900 CVE-2014-3604 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1131803  View
675375 70900 CVE-2014-3604 MISC:https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml  View
675376 70900 CVE-2014-3604 CONFIRM:http://juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172  View
675377 70900 CVE-2014-3604 XF:notyetcommons-cve20143604-sec-bypass(97659)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
19230 JVNDB-2014-008107 Apache ActiveMQ の Java Authentication and Authorization Service の LDAPLoginModule の実装における認証を回避される脆弱性 Apache ActiveMQ の Java Authentication and Authorization Service (JAAS) の LDAPLoginModule の実装には、認証を回避される脆弱性が存在します。 CVE-2014-3612 70900 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008107.html  View