CVE-2014-3604: Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Summary
CVE-2014-3604: Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL. Affects ca.juliusdavies:not-yet-commons-ssl versions < 0.3.15. Fixed in 0.3.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is ca.juliusdavies:not-yet-commons-ssl, an open-source library for SSL and TLS functionality. It is commonly used in Maven projects. Not Yet Commons SSL provides various utilities for SSL and TLS, including certificate handling and validation. This vulnerability affects versions prior to 0.3.15 of the library.
Vulnerability Detail
The vulnerability in Not Yet Commons SSL (ca.juliusdavies:not-yet-commons-ssl) arises from improper validation of certificates with host mismatches. The Certificates.java file in versions before 0.3.15 does not correctly verify that the server hostname matches the domain name in the subject's Common Name (CN) field of the X.509 certificate. This flaw allows attackers to perform man-in-the-middle attacks by spoofing SSL servers using arbitrary valid certificates. The impact of this vulnerability is significant, as it undermines the integrity and security of SSL/TLS connections.
How To Fix
Minimum fixed version
0.3.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the library to mitigate the risk.
Conclusion
In conclusion, the vulnerability CVE-2014-3604 in ca.juliusdavies:not-yet-commons-ssl allows for man-in-the-middle attacks by spoofing SSL servers. To mitigate this risk, it is crucial to upgrade to version 0.3.15 or later of the library. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ca.juliusdavies:not-yet-commons-ssl →
FAQ
ca.juliusdavies:not-yet-commons-ssl is an open-source library for SSL and TLS functionality, commonly used in Maven projects.
This vulnerability allows man-in-the-middle attackers to spoof SSL servers, compromising the security and integrity of SSL/TLS connections.
To fix this vulnerability, upgrade to version 0.3.15 or later of ca.juliusdavies:not-yet-commons-ssl.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
For more information, you can refer to the CVE identifier CVE-2014-3604 and the GitHub advisory GHSA-cmxj-wx9v-52qr.
