search

gsylvie / madness

1 stars 2 forks source link

CVE-2014-3596 Medium Severity Vulnerability detected by WhiteSource - autoclosed #151

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 5 years ago

CVE-2014-3596 - Medium Severity Vulnerability

Vulnerable Library - axis-1.4.jar

An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.

path: 2/repository/axis/axis/1.4/axis-1.4.jar

Library home page: http://ws.apache.org/axis

Dependency Hierarchy: - :x: **axis-1.4.jar** (Vulnerable Library)

Vulnerability Details

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

Publish Date: 2014-08-27

URL: CVE-2014-3596

CVSS 2 Score Details (5.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://xforce.iss.net/xforce/xfdb/95377

Release Date: 2017-12-31

Fix Resolution: Refer to Apache Web site for patch, upgrade or suggested workaround information. See References. For IBM products: Refer to the appropriate IBM Security Bulletin for patch, upgrade or suggested workaround information. See References. For other distributions: Apply the appropriate update for your system.

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #507