Apache Axis2/C SSL/TLS Hostname Validation Issue

CVE-2012-6107

Summary

The Apache Axis2/C framework suffers from a flaw where it fails to verify that the server's hostname matches the domain name in the Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight can be exploited by malicious actors through man-in-the-middle attacks, allowing them to present arbitrary valid certificates and potentially spoof SSL servers. As a result, sensitive data transmitted between clients and servers could be intercepted, posing significant risks to the integrity and confidentiality of communications.

References