CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1913 vulnerabilities reference this CWE, most recent first.
GHSA-62RC-F4V9-H543
Vulnerability from github – Published: 2026-02-02 23:24 – Updated: 2026-02-03 19:01Summary
SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found.
Impact
Arbitrary Code Execution: Disabling SSL verification allows third parties to intercept HTTPS traffic and replace models or dependencies with inappropriate versions. This could lead to remote code execution in the Triton container.
Impacted versions
- SageMaker Python SDK v3 < v3.1.1
- SageMaker Python SDK v2 < v2.256.0
Patches
This issue has been addressed in SageMaker Python SDK version v3.1.1 and v2.256.0. It is recommended to upgrade to the latest version immediately and ensure any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Customers using self-signed certificates for internal model downloads should add their private Certificate Authority (CA) certificate to the container image rather than relying on the SDK’s previous insecure configuration. This opt-in approach maintains security while accommodating internal trusted domains.
References
If there are any questions or comments about this advisory, contact AWS Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "sagemaker"
},
"ranges": [
{
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "sagemaker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.256.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-1778"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-599"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T23:24:50Z",
"nvd_published_at": "2026-02-02T23:16:04Z",
"severity": "HIGH"
},
"details": "### Summary\nSageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found.\n\n### Impact\nArbitrary Code Execution: Disabling SSL verification allows third parties to intercept HTTPS traffic and replace models or dependencies with inappropriate versions. This could lead to remote code execution in the Triton container.\n\n### Impacted versions\n\n- SageMaker Python SDK v3 \u003c v3.1.1\n- SageMaker Python SDK v2 \u003c v2.256.0\n\n### Patches\nThis issue has been addressed in SageMaker Python SDK version [v3.1.1](https://github.com/aws/sagemaker-python-sdk/tree/1ab6d30401946e92fdbea18497675681649e0153) and [v2.256.0](https://github.com/aws/sagemaker-python-sdk/tree/a140cfcd12abfee10254cb4dea3bb10758e4321c). It is recommended to upgrade to the latest version immediately and ensure any forked or derivative code is patched to incorporate the new fixes.\n\n### Workarounds\nCustomers using self-signed certificates for internal model downloads should add their private Certificate Authority (CA) certificate to the container image rather than relying on the SDK\u2019s previous insecure configuration. This opt-in approach maintains security while accommodating internal trusted domains.\n\n### References\nIf there are any questions or comments about this advisory, contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
"id": "GHSA-62rc-f4v9-h543",
"modified": "2026-02-03T19:01:03Z",
"published": "2026-02-02T23:24:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-62rc-f4v9-h543"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1778"
},
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/commit/5e7a3efa7bec0a161194ffa0cef346dda93bf2c6"
},
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/commit/c8098958910f7db78d07037425debfd4d44a6964"
},
{
"type": "WEB",
"url": "https://aws.amazon.com/security/security-bulletins/2026-004-AWS"
},
{
"type": "PACKAGE",
"url": "https://github.com/aws/sagemaker-python-sdk"
},
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.256.0"
},
{
"type": "WEB",
"url": "https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.1.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "SageMaker Python SDK has Insecure TLS Configuration"
}
GHSA-63VM-7C93-254F
Vulnerability from github – Published: 2025-07-10 03:32 – Updated: 2025-07-10 03:32Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected.
This issue affects Controller 7000:
9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).
{
"affected": [],
"aliases": [
"CVE-2025-35983"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-10T03:15:28Z",
"severity": "MODERATE"
},
"details": "Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected. \n\nThis issue affects Controller 7000: \n\n9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).",
"id": "GHSA-63vm-7c93-254f",
"modified": "2025-07-10T03:32:12Z",
"published": "2025-07-10T03:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35983"
},
{
"type": "WEB",
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35983"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6474-3M8H-Q35J
Vulnerability from github – Published: 2023-06-16 18:30 – Updated: 2023-12-14 03:30An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users via eavesdropping.
{
"affected": [],
"aliases": [
"CVE-2023-30222"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-16T17:15:11Z",
"severity": "HIGH"
},
"details": "An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to retrieve password hashes for all users via eavesdropping.",
"id": "GHSA-6474-3m8h-q35j",
"modified": "2023-12-14T03:30:52Z",
"published": "2023-06-16T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30222"
},
{
"type": "WEB",
"url": "https://blog.4d.com/security-bulletin-two-cves-and-how-to-stay-secure"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com"
},
{
"type": "WEB",
"url": "https://www.infigo.is/en/insights/42/information-disclosure-and-broken-authentication-in-4d-sas-4d-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-64FF-HJJG-HWR8
Vulnerability from github – Published: 2023-10-17 15:30 – Updated: 2024-04-04 08:43OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials
{
"affected": [],
"aliases": [
"CVE-2022-3761"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-17T13:15:11Z",
"severity": "MODERATE"
},
"details": "OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials",
"id": "GHSA-64ff-hjjg-hwr8",
"modified": "2024-04-04T08:43:06Z",
"published": "2023-10-17T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3761"
},
{
"type": "WEB",
"url": "https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log"
},
{
"type": "WEB",
"url": "https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-65F4-H7GH-6C3F
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would be able to harvest sensitive information.
{
"affected": [],
"aliases": [
"CVE-2021-40713"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-27T16:15:00Z",
"severity": "MODERATE"
},
"details": "Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would be able to harvest sensitive information.",
"id": "GHSA-65f4-h7gh-6c3f",
"modified": "2022-05-24T19:15:45Z",
"published": "2022-05-24T19:15:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40713"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-65FC-5256-7M67
Vulnerability from github – Published: 2022-05-13 01:06 – Updated: 2025-04-20 03:37The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-8935"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-15T18:29:00Z",
"severity": "MODERATE"
},
"details": "The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-65fc-5256-7m67",
"modified": "2025-04-20T03:37:44Z",
"published": "2022-05-13T01:06:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8935"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-65GG-3W2W-HR4H
Vulnerability from github – Published: 2025-06-25 21:57 – Updated: 2025-11-29 03:30Impact
The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.
Patches
https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2
Workarounds
Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v4"
},
"ranges": [
{
"events": [
{
"introduced": "4.8.0"
},
{
"last_affected": "4.9.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-6032"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-25T21:57:00Z",
"nvd_published_at": "2025-06-24T14:15:30Z",
"severity": "HIGH"
},
"details": "### Impact\nThe podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.\n\n### Patches\nhttps://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3\nFixed in v5.5.2\n\n### Workarounds\nDownload the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)",
"id": "GHSA-65gg-3w2w-hr4h",
"modified": "2025-11-29T03:30:15Z",
"published": "2025-06-25T21:57:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6032"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/podman"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372501"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-6032"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:9766"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:9751"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:9726"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:15397"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:11681"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:11677"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:11363"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:11359"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10668"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10550"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:10295"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Podman Improper Certificate Validation; machine missing TLS verification"
}
GHSA-65RM-H285-5CC5
Vulnerability from github – Published: 2019-08-16 14:02 – Updated: 2024-11-25 19:24In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Twisted"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "19.7.0rc1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-12855"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2019-08-12T15:06:23Z",
"nvd_published_at": "2019-06-16T12:29:00Z",
"severity": "CRITICAL"
},
"details": "In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.",
"id": "GHSA-65rm-h285-5cc5",
"modified": "2024-11-25T19:24:13Z",
"published": "2019-08-16T14:02:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12855"
},
{
"type": "WEB",
"url": "https://github.com/twisted/twisted/pull/1147"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-129.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/twisted/twisted"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ"
},
{
"type": "WEB",
"url": "https://twistedmatrix.com/trac/ticket/9561"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4308-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4308-2"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper Certificate Validation in Twisted"
}
GHSA-663H-2VR3-GHRJ
Vulnerability from github – Published: 2026-02-23 18:32 – Updated: 2026-02-25 22:46An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "yapi-vendor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-70058"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-25T22:46:40Z",
"nvd_published_at": "2026-02-23T16:29:36Z",
"severity": "HIGH"
},
"details": "An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting \u0027rejectUnauthorized\u0027: false in the HTTPS agent configuration for Axios requests",
"id": "GHSA-663h-2vr3-ghrj",
"modified": "2026-02-25T22:46:40Z",
"published": "2026-02-23T18:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70058"
},
{
"type": "WEB",
"url": "https://gist.github.com/zcxlighthouse/11c53803faf23f607c2787c166e811d4"
},
{
"type": "WEB",
"url": "https://github.com/YMFE"
},
{
"type": "PACKAGE",
"url": "https://github.com/YMFE/yapi"
},
{
"type": "WEB",
"url": "https://github.com/YMFE/yapi/blob/59bade3a8a43e7db077d38a4b0c7c584f30ddf8c/common/postmanLib.js#L110"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent"
}
GHSA-67FW-W8F2-88WP
Vulnerability from github – Published: 2024-08-01 18:32 – Updated: 2024-08-16 18:39An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/casdoor/casdoor"
},
"ranges": [
{
"events": [
{
"introduced": "1.541.0"
},
{
"last_affected": "1.636.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41264"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-295",
"CWE-297"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T13:29:15Z",
"nvd_published_at": "2024-08-01T16:15:06Z",
"severity": "MODERATE"
},
"details": "An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the `ssh.InsecureIgnoreHostKey()` method.",
"id": "GHSA-67fw-w8f2-88wp",
"modified": "2024-08-16T18:39:40Z",
"published": "2024-08-01T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41264"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f"
},
{
"type": "PACKAGE",
"url": "https://github.com/casdoor/casdoor"
},
{
"type": "WEB",
"url": "https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "casdoor\u0027s use of`ssh.InsecureIgnoreHostKey()` disables host key verification"
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.