CVE-2012-5785

Currently unrated

Key Information:

Vendor
Apache
Status
Axis2
Vendor
CVE Published:
4 November 2012

Summary

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References

http://secunia.com/advisories/51219
third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/79830
vdb-entryx_refsource_XF
http://www.securityfocus.com/bid/56408
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.