CVE-2014-5075 Security Details

CVE ID

CVE-2014-5075

CWE

CWE-310

CVE Description

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Published

Mar 20, 2019

CVSS Score & Severity

6.8Medium

CVSS Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Score

0.236%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/jivesoftware/smack/ConnectionConfiguration.setCustomSSLContext(Ljavax/net/ssl/SSLContext;)V

JVM

org/jivesoftware/smack/XMPPConnection.proceedTLSReceived()V

JVM

org/jivesoftware/smack/XMPPTCPConnection.proceedTLSReceived()V

JVM

org/jivesoftware/smack/tcp/XMPPTCPConnection.proceedTLSReceived()V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Red Hat · Bugzilla #1127276THIRD_PARTY

op-co.deTHIRD_PARTY