The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 01:55
Type | Values Removed | Values Added |
---|---|---|
References | () http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897 - | |
References | () http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html - | |
References | () http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html - | |
References | () http://marc.info/?l=bugtraq&m=141390017113542&w=2 - | |
References | () http://rhn.redhat.com/errata/RHSA-2013-1307.html - Vendor Advisory | |
References | () http://rhn.redhat.com/errata/RHSA-2013-1615.html - | |
References | () http://secunia.com/advisories/54478 - Vendor Advisory | |
References | () http://secunia.com/advisories/54657 - Vendor Advisory | |
References | () http://secunia.com/advisories/55078 - Vendor Advisory | |
References | () http://secunia.com/advisories/59652 - | |
References | () http://support.apple.com/kb/HT6150 - | |
References | () http://www.debian.org/security/2013/dsa-2742 - | |
References | () http://www.php.net/ChangeLog-5.php - | |
References | () http://www.securityfocus.com/bid/61776 - | |
References | () http://www.securitytracker.com/id/1028924 - | |
References | () http://www.ubuntu.com/usn/USN-1937-1 - Vendor Advisory |
07 Nov 2023, 02:16
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2013-08-18 02:52
Updated : 2024-11-21 01:55
NVD link : CVE-2013-4248
Mitre link : CVE-2013-4248
CVE.ORG link : CVE-2013-4248
JSON object : View
Products Affected
canonical
- ubuntu_linux
php
- php
redhat
- enterprise_linux
CWE
CWE-20
Improper Input Validation