[AXIS-2883] Insecure certificate validation CVE-2012-5784

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.4
• Environment: All
• Assignee: Robert Lazarski
• Reporter: Alberto Fernández
• Created: 22/Nov/12 23:25
• Updated: 21/Dec/21 00:36
• Resolved: 03/Jul/15 23:29

Description

See.
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Using JSSE you must manually validate server name you're connecting to matches one of the names provided by the certificate. So you can detect a man-in-the-middle type attack with a valid certificate for other site.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784

Issue Links

• is superceded by: AXIS-2905 Insecure certificate validation CVE-2014-3596