GitHub Advisoryadvisory · Maven

GHSA-273v-g3x4-r3rc Improper Certificate Validation in vt-ldap

MEDIUM Published 2022-05-14 Modified 2022-11-01 Official page ↗
Aliases
CVE-2014-3607
Ecosystem
Maven
Packages
edu.vt.middleware:vt-ldap, edu.internet2.middleware:shibboleth-identityprovider
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-295
Reviewed
2022-11-01

Affected packages

• Maven edu.vt.middleware:vt-ldap: < 3.3.8 → fixed in 3.3.8 • Maven edu.internet2.middleware:shibboleth-identityprovider: < 2.4.2 → fixed in 2.4.2

Description

DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Related

Alias · CVE (1)

  • CVE-2014-3607 DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References