CVE-2014-3607

DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ldaptive:ldaptive:*:*:*:*:*:*:*:*
cpe:2.3:a:ldaptive:vt-ldap:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-01-08 19:29

Updated : 2024-02-28 16:04


NVD link : CVE-2014-3607

Mitre link : CVE-2014-3607

CVE.ORG link : CVE-2014-3607


JSON object : View

Products Affected

ldaptive

  • vt-ldap
  • ldaptive
CWE
CWE-295

Improper Certificate Validation