GitHub Advisoryadvisory · Maven

GHSA-r53v-vm87-f72c Improper Validation of Certificates in apache axis

MEDIUM Published 2018-10-16 Modified 2024-03-01 Official page ↗
Aliases
CVE-2014-3596
Ecosystem
Maven
Packages
org.apache.axis:axis, axis:axis
Severity
Moderate
Weaknesses
CWE-297
Reviewed
2020-06-16

Affected packages

• Maven org.apache.axis:axis: <= 1.4 (no fix yet) • Maven axis:axis: <= 1.4 (no fix yet)

Description

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

Related

Alias · CVE (1)

  • CVE-2014-3596 The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's… vulnerability

Weakness · CWE (1)

  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness

References