CVE-2015-2318 — Improper Certificate Validation in Mono

CWE-295 — Improper Certificate Validation7 documents6 sources
Severity
8.1HIGHNVD
OSV5.8
EPSS
1.3%
top 20.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
MonoMono-project MonoDebian Mono+1 more
Timeline
PublishedJan 8
Latest updateMay 14

Description

The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/mono< mono 3.2.8+dfsg-10 (bookworm)
▶NVDmono-project/mono< 3.12.1
▶Debianmono/mono< 3.2.8+dfsg-10+3
▶Ubuntumono/mono< 3.2.8+dfsg-4ubuntu1.1

Also affects: Debian Linux 6.0

🔴Vulnerability Details

3
GHSA
GHSA-xv64-wpfr-x2m3: The TLS stack in Mono before 3↗2022-05-14
▶
OSV
CVE-2015-2318: The TLS stack in Mono before 3↗2018-01-08
▶
OSV
mono vulnerabilities↗2015-03-24
▶

📋Vendor Advisories

2
Ubuntu
Mono vulnerabilities↗2015-03-24
▶
Debian
CVE-2015-2318: mono - The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduc...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-2318 CVE-2015-2319 CVE-2015-2320 mono: TLS implementation vulnerabilities↗2015-03-17
▶