CVE-2014-3596
- State
- Published
- Severity
- Not scored
- Published
- Aug 27, 2014
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2014
Description
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20140820 CVE-2014-3596 - Apache Axis 1 vulnerable to MITM attackmailing-list
- https://issues.apache.org/jira/browse/AXIS-2905
- apache-axis-cve20143596-spoofing(95377)vdb-entry
- 1030745vdb-entry
- 61222third-party-advisory
- RHSA-2014:1193vendor-advisory
- 69295vdb-entry
- http://linux.oracle.com/errata/ELSA-2014-1193.html
- [axis-java-dev] 20190503 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596mailing-list
- [axis-java-dev] 20190503 [jira] [Comment Edited] (AXIS-2905) Insecure certificate validation CVE-2014-3596mailing-list
- openSUSE-SU-2019:1497vendor-advisory
- openSUSE-SU-2019:1526vendor-advisory
- [axis-java-dev] 20190907 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596mailing-list
- [axis-java-dev] 20190909 [jira] [Resolved] (AXIS-2905) Insecure certificate validation CVE-2014-3596mailing-list
- [axis-java-dev] 20190909 [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596mailing-list
- https://www.oracle.com/security-alerts/cpujan2020.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.