CVE-2002-0970

CWE-3587 documents6 sources
Severity
7.5HIGH
EPSS
2.4%
top 14.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
KDE KDEKDE Konqueror
Timeline
PublishedSep 24
Latest updateMay 3

Description

The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDkde/konqueror4 versions+3
▶NVDkde/kde4 versions+3

Patches

Patch: www.debian.org ↗Patch: www.securityfocus.com ↗Patch: www.debian.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-x288-6jm2-5j5c: The SSL capability for Konqueror in KDE 3↗2022-05-03
▶
CVEList
CVE-2002-0970: The SSL capability for Konqueror in KDE 3↗2004-09-01
▶

📋Vendor Advisories

2
Red Hat
security flaw↗2002-08-12
▶
Red Hat
CVE-2009-0653: OpenSSL, probably 0↗
▶

📐Framework References

1
CWE
Improperly Implemented Security Check for Standard
▶

💬Community

1
Bugzilla
CVE-2002-0970 security flaw↗2018-08-16
▶