The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Fix Resolution: Refer to Apache Web site for patch, upgrade or suggested workaround information. See References.
For IBM products:
Refer to the appropriate IBM Security Bulletin for patch, upgrade or suggested workaround information. See References.
For other distributions:
Apply the appropriate update for your system.
Step up your Open Source Security Game with WhiteSource here
CVE-2014-3596 - Medium Severity Vulnerability
Vulnerable Library - axis-1.4.jar
An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.
path: 2/repository/axis/axis/1.4/axis-1.4.jar
Library home page: http://ws.apache.org/axis
Dependency Hierarchy: - :x: **axis-1.4.jar** (Vulnerable Library)Vulnerability Details
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Publish Date: 2014-08-27
URL: CVE-2014-3596
CVSS 2 Score Details (5.8)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: http://xforce.iss.net/xforce/xfdb/95377
Release Date: 2017-12-31
Fix Resolution: Refer to Apache Web site for patch, upgrade or suggested workaround information. See References. For IBM products: Refer to the appropriate IBM Security Bulletin for patch, upgrade or suggested workaround information. See References. For other distributions: Apply the appropriate update for your system.
Step up your Open Source Security Game with WhiteSource here