CVE-2013-4508
- State
- Published
- Severity
- Not scored
- Published
- Nov 8, 2013
- Updated
- Aug 6, 2024
- Reserved
- Jun 12, 2013
Description
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt
- [oss-security] 20131104 Re: CVE Request: lighttpd using vulnerable cipher suites with SNImailing-list
- HPSBGN03191vendor-advisory
- http://redmine.lighttpd.net/issues/2525
- openSUSE-SU-2014:0072vendor-advisory
- DSA-2795vendor-advisory
- http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2913/diff/
- JVN#37417423third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.