CVE-2014-3604

Published: Oct 25, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected (1)

Products: Not Yet Commons Ssl Project: Not Yet Commons Ssl

Not Yet Commons Ssl Project

1 product

Not Yet Commons Ssl

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Not Yet Commons Ssl Project Not Yet Commons Ssl	version ≤ 0.3.14

Related CWEs

References (10)

http://juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172

Source: secalert@redhat.com

Patch

http://rhn.redhat.com/errata/RHSA-2015-1888.html

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1131803

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/97659

Source: secalert@redhat.com

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml

Source: secalert@redhat.com

http://juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://rhn.redhat.com/errata/RHSA-2015-1888.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1131803

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/97659

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.