CVE-2014-3504

Currently unrated

Key Information:

Vendor
Apache
Status
Subversion
Vendor
CVE Published:
19 August 2014

Summary

The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

References

http://ubuntu.com/usn/usn-2315-1
vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/69238
vdb-entryx_refsource_BID
http://secunia.com/advisories/60721
third-party-advisoryx_refsource_SECUNIA

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.