CVEvulnerability
CVE-2015-3996
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-10-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-254
Description
The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected configurations
• afnetworking project afnetworking (<= 2.5.2)
Related
Weakness · not in database (1)
References
- http://www.securityfocus.com/bid/76242 www.securityfocus.com
- https://github.com/AFNetworking/AFNetworking/issues/2619 github.com
- https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3 github.com
- https://owncloud.org/security/advisory/?id=oc-sa-2015-012 Vendor Advisory
- http://www.securityfocus.com/bid/76242 www.securityfocus.com
- https://github.com/AFNetworking/AFNetworking/issues/2619 github.com
- https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3 github.com
- https://owncloud.org/security/advisory/?id=oc-sa-2015-012 Vendor Advisory