CVE-2014-3596
published 2014-08-27CVE-2014-3596: The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or…
PriorityP431medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
5.81%
92.3th percentile
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | axis | <= 1.4 | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | — | — |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| apache | axis | >= 0 < 1.4-21 | 1.4-21 |
| debian | axis | < axis 1.4-21 (bookworm) | axis 1.4-21 (bookworm) |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa5.8MEDIUM
osv5.8MEDIUM
vendor_debian5.8LOW
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
vendor_redhat·2014-08-19·CVSS 5.8
CVE-2014-3596 [MEDIUM] CWE-297 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
Statement: Note that Axis 1 is EOL upstream, and
Debian
CVE-2014-3596: axis - The getCN function in Apache Axis 1.4 and earlier does not properly verify that ...
vendor_debian·2014·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596: axis - The getCN function in Apache Axis 1.4 and earlier does not properly verify that ...
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Scope: local
bookworm: resolved (fixed in 1.4-21)
bullseye: resolved (fixed in 1.4-21)
forky: resolved (fixed in 1.4-21)
sid: resolved (fixed in 1.4-21)
trixie: resolved (fixed in 1.4-21)
OSV
Improper Validation of Certificates in apache axis
osv·2018-10-16·CVSS 5.8
CVE-2014-3596 [MEDIUM] Improper Validation of Certificates in apache axis
Improper Validation of Certificates in apache axis
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
GHSA
Improper Validation of Certificates in apache axis
ghsa·2018-10-16·CVSS 5.8
CVE-2014-3596 [MEDIUM] CWE-297 Improper Validation of Certificates in apache axis
Improper Validation of Certificates in apache axis
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
OSV
CVE-2014-3596: The getCN function in Apache Axis 1
osv·2014-08-27·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596: The getCN function in Apache Axis 1
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
bugzilla·2014-08-14·CVSS 5.8
CVE-2014-3596 [MEDIUM] CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix
It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate using a specially crafted subject.
Discussion:
Statement:
Note that Axis 1 is EOL upstream, and the incomplete patch for CVE-2012-5784 was never merged upstream. It was, however, shipped by various vendors, including Debian and Red Hat. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1164433
Acknowledgements:
This issue was discovered by David Jorm and Arun Neelicattu
Bugzilla
CVE-2012-5784 axis: missing connection hostname check against X.509 certificate name
bugzilla·2012-11-05·CVSS 5.8
CVE-2012-5784 [MEDIUM] CVE-2012-5784 axis: missing connection hostname check against X.509 certificate name
CVE-2012-5784 axis: missing connection hostname check against X.509 certificate name
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5784 to the following vulnerability:
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/
http://linux.oracle.com/errata/ELSA-2014-1193.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1193.htmlhttp://secunia.com/advisories/61222http://www.openwall.com/lists/oss-security/2014/08/20/2http://www.securityfocus.com/bid/69295http://www.securitytracker.com/id/1030745https://exchange.xforce.ibmcloud.com/vulnerabilities/95377https://issues.apache.org/jira/browse/AXIS-2905https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3Ehttps://www.oracle.com/security-alerts/cpujan2020.htmlhttp://linux.oracle.com/errata/ELSA-2014-1193.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1193.htmlhttp://secunia.com/advisories/61222http://www.openwall.com/lists/oss-security/2014/08/20/2http://www.securityfocus.com/bid/69295http://www.securitytracker.com/id/1030745https://exchange.xforce.ibmcloud.com/vulnerabilities/95377https://issues.apache.org/jira/browse/AXIS-2905https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3Ehttps://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3Ehttps://www.oracle.com/security-alerts/cpujan2020.html
2014-08-27
Published