Beveiligingsadvies

CVE-2014-3603

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2019-04-04 13:38:16

Laatst bijgewerkt 2024-08-06 10:50:17

Toegewezen door redhat

CVSS-score geen score

Status PUBLISHED

Beschrijving

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

← Alle CVE's bekijken Bekijk op cve.org ↗