CVE-2014-3596

CWE-2978 documents7 sources
Severity
5.8MEDIUM
EPSS
1.2%
top 20.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Axis
Timeline
PublishedAug 27
Latest updateOct 16

Description

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages4 packages

▶NVDapache/axis1.4+5
▶Debianaxis< 1.4-21+3
▶Mavenaxis:axis1.4

Patches

Patch: issues.apache.org ↗Patch: issues.apache.org ↗

🔴Vulnerability Details

4
OSV
Improper Validation of Certificates in apache axis↗2018-10-16
▶
GHSA
Improper Validation of Certificates in apache axis↗2018-10-16
▶
CVEList
CVE-2014-3596: The getCN function in Apache Axis 1↗2014-08-27
▶
OSV
CVE-2014-3596: The getCN function in Apache Axis 1↗2014-08-27
▶

📋Vendor Advisories

2
Red Hat
axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix↗2014-08-19
▶
Debian
CVE-2014-3596: axis - The getCN function in Apache Axis 1.4 and earlier does not properly verify that ...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-3596 axis: SSL hostname verification bypass, incomplete CVE-2012-5784 fix↗2014-08-14
▶
CVE-2014-3596 (MEDIUM CVSS 5.8) | The getCN function in Apache Axis 1 | cvebase.io