GitHub Advisoryadvisory · Maven

GHSA-4hxv-95rc-jqg7 nv-websocket-client allows attackers to spoof SSL/TLS servers via an arbitrary valid certificate

MEDIUM Published 2022-05-17 Modified 2022-11-08 Official page ↗
Aliases
CVE-2017-1000209
Ecosystem
Maven
Packages
com.neovisionaries:nv-websocket-client
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-295
Reviewed
2022-11-08

Affected packages

• Maven com.neovisionaries:nv-websocket-client: < 2.1 → fixed in 2.1

Description

The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.

Related

Alias · CVE (1)

  • CVE-2017-1000209 The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References