| Summary: | CVE-2014-3604 Not Yet Commons SSL: Hostname verification susceptible to MITM attack | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Arun Babu Neelicattu <aneelica> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | grocha, mjc, pavelp, ppecka, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | commons-ssl 0.3.15 | Doc Type: | Bug Fix |
| Doc Text: |
It was discovered that the implementation used by the Not Yet Commons SSL project to check that the server hostname matches the domain name in the subject's CN field was flawed. This could be exploited by a man-in-the-middle attacker by spoofing a valid certificate using a specially crafted subject.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-03-18 18:39:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 1132747, Red Hat1132749 | ||
| Bug Blocks: | Embargoed1131826, Embargoed1244362 | ||
|
Description
Arun Babu Neelicattu
2014-08-20 05:56:47 UTC
Acknowledgements: This issue was discovered by Arun Babu Neelicattu of Red Hat Product Security. Statement: Red Hat JBoss SOA Platform 4 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ Created not-yet-commons-ssl tracking bugs for this issue: Affects: fedora-all [bug 1132747] This issue has been addressed in the following products: Red Hat JBoss SOA Platform 5.3.1 Via RHSA-2015:1888 https://rhn.redhat.com/errata/RHSA-2015-1888.html |