Common Weakness Enumeration
CWE-300
DiscouragedChannel Accessible by Non-Endpoint
Abstraction: Class · Status: Draft
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
99 vulnerabilities reference this CWE, most recent first.
GHSA-F7W7-6PJC-WWM6
Vulnerability from github – Published: 2022-05-02 03:46 – Updated: 2026-06-08 23:46
VLAI
Summary
Apache Tomcat affected by vulnerability in TLS and SSL protocol
Details
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Apache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.32"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.5.33"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2009-3555"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-22T19:39:23Z",
"nvd_published_at": "2009-11-09T17:30:00Z",
"severity": "CRITICAL"
},
"details": "The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.\n\nApache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.",
"id": "GHSA-f7w7-6pjc-wwm6",
"modified": "2026-06-08T23:46:14Z",
"published": "2022-05-02T03:46:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3555"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/df9633116b5fec8f47f1f008fb89a6e9d5895cd0"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/b4e9488629bf03b4b65abf335e536e85386d1366"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/56f67141e82e16f68a860c3af9b7342da35cbe7d"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/3d315ac9dfaa2c03b4df82938d78bf5b755766b3"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/328a523cbb2a2d4cd55283180614d4e03e2f8f02"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/30af3f5630542a2340781f66553e734a6fd69701"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/2d4ca03acc27cc883c404d1745d92f983b6fada3"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/14e4efd925da58b9fa63f20969fb7349b8a9c30d"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://kb.bluecoat.com/index?page=content\u0026id=SA50"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/10579"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-7.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-6.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-5.html"
},
{
"type": "WEB",
"url": "https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt"
},
{
"type": "WEB",
"url": "https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8535"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8366"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7973"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7478"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7315"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11617"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11578"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0440"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0408"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0339"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0338"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0337"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0167"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0166"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0165"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0164"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0163"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0162"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0155"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0130"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0119"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0011"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1694"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1580"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1579"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54158"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049"
},
{
"type": "WEB",
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=50325"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=533125"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=545755"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=526689"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2009-3555"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2015:1591"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2011:0880"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0987"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0986"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0865"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0807"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0786"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0768"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html"
},
{
"type": "WEB",
"url": "http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html"
},
{
"type": "WEB",
"url": "http://blogs.iss.net/archive/sslmitmiscsrf.html"
},
{
"type": "WEB",
"url": "http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during"
},
{
"type": "WEB",
"url": "http://clicky.me/tlsvuln"
},
{
"type": "WEB",
"url": "http://extendedsubset.com/?p=8"
},
{
"type": "WEB",
"url": "http://extendedsubset.com/Renegotiating_TLS.pdf"
},
{
"type": "WEB",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686"
},
{
"type": "WEB",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041"
},
{
"type": "WEB",
"url": "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751"
},
{
"type": "WEB",
"url": "http://kbase.redhat.com/faq/docs/DOC-20491"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//May/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010//May/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html"
},
{
"type": "WEB",
"url": "http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=apache-httpd-announce\u0026m=125755783724966\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=126150535619567\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=127128920008563\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=127419602507642\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=127557596201693\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=130497311408250\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=132077688910227\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=134254866602253\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=142660345230545\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=cryptography\u0026m=125752275331877\u0026w=2"
},
{
"type": "WEB",
"url": "http://openbsd.org/errata45.html#010_openssl"
},
{
"type": "WEB",
"url": "http://openbsd.org/errata46.html#004_openssl"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2009/Nov/139"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200912-01.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201203-22.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1023148"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.597446"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4004"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4170"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4171"
},
{
"type": "WEB",
"url": "http://support.avaya.com/css/P8/documents/100070150"
},
{
"type": "WEB",
"url": "http://support.avaya.com/css/P8/documents/100081611"
},
{
"type": "WEB",
"url": "http://support.avaya.com/css/P8/documents/100114315"
},
{
"type": "WEB",
"url": "http://support.avaya.com/css/P8/documents/100114327"
},
{
"type": "WEB",
"url": "http://support.citrix.com/article/CTX123359"
},
{
"type": "WEB",
"url": "http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES"
},
{
"type": "WEB",
"url": "http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released"
},
{
"type": "WEB",
"url": "http://sysoev.ru/nginx/patch.cve-2009-3555.txt"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html"
},
{
"type": "WEB",
"url": "http://ubuntu.com/usn/usn-923-1"
},
{
"type": "WEB",
"url": "http://wiki.rpath.com/Advisories:rPSA-2009-0155"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21426108"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21432298"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg24006386"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg24025312"
},
{
"type": "WEB",
"url": "http://www-1.ibm.com/support/search.wss?rs=0\u0026q=PM00675\u0026apar=only"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/support/alerts/aid-020810.txt"
},
{
"type": "WEB",
"url": "http://www.betanews.com/article/1257452450"
},
{
"type": "WEB",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1934"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2011/dsa-2141"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3253"
},
{
"type": "WEB",
"url": "http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html"
},
{
"type": "WEB",
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html"
},
{
"type": "WEB",
"url": "http://www.ietf.org/mail-archive/web/tls/current/msg03928.html"
},
{
"type": "WEB",
"url": "http://www.ietf.org/mail-archive/web/tls/current/msg03948.html"
},
{
"type": "WEB",
"url": "http://www.ingate.com/Relnote.php?ver=481"
},
{
"type": "WEB",
"url": "http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/120541"
},
{
"type": "WEB",
"url": "http://www.links.org/?p=780"
},
{
"type": "WEB",
"url": "http://www.links.org/?p=786"
},
{
"type": "WEB",
"url": "http://www.links.org/?p=789"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:076"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2010/mfsa2010-22.html"
},
{
"type": "WEB",
"url": "http://www.openoffice.org/security/cves/CVE-2009-3555.html"
},
{
"type": "WEB",
"url": "http://www.openssl.org/news/secadv_20091111.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/05/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/05/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/06/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/07/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/20/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/11/23/10"
},
{
"type": "WEB",
"url": "http://www.opera.com/docs/changelogs/unix/1060"
},
{
"type": "WEB",
"url": "http://www.opera.com/support/search/view/944"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html"
},
{
"type": "WEB",
"url": "http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0119.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0130.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0155.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0165.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0167.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0337.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0338.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0339.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0768.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0770.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0786.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0807.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0865.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0986.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0987.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0880.html"
},
{
"type": "WEB",
"url": "http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/507952/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/508075/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/508130/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/515055/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/522176"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36935"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023163"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023204"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023205"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023206"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023207"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023208"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023209"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023210"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023211"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023212"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023213"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023214"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023215"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023216"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023217"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023218"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023219"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023224"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023243"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023270"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023271"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023272"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023273"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023274"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023275"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023411"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023426"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023427"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023428"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1024789"
},
{
"type": "WEB",
"url": "http://www.tombom.co.uk/blog/?p=85"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1010-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-927-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-927-4"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-927-5"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-287A.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2010-0019.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
},
{
"type": "WEB",
"url": "http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Tomcat affected by vulnerability in TLS and SSL protocol"
}
GHSA-FHHQ-WP7P-MXF8
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36
VLAI
Details
A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle (MitM) attack.
Severity
7.4 (High)
{
"affected": [],
"aliases": [
"CVE-2017-6870"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-08T00:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle (MitM) attack.",
"id": "GHSA-fhhq-wp7p-mxf8",
"modified": "2022-05-13T01:36:23Z",
"published": "2022-05-13T01:36:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6870"
},
{
"type": "WEB",
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-589378.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99582"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FR73-3M84-8RCH
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2022-05-13 01:37
VLAI
Details
It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6.
Severity
7.4 (High)
{
"affected": [],
"aliases": [
"CVE-2017-15086"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-08T19:29:00Z",
"severity": "HIGH"
},
"details": "It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6.",
"id": "GHSA-fr73-3m84-8rch",
"modified": "2022-05-13T01:37:35Z",
"published": "2022-05-13T01:37:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15086"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3110"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-15086"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1505785"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15086"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101555"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FX6X-H9G4-56F8
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2023-08-22 14:31
VLAI
Summary
containernetworking/plugins vulnerable to MitM attacks
Details
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
Severity
6.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containernetworking/plugins"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-10749"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-13T20:04:42Z",
"nvd_published_at": "2020-06-03T14:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.",
"id": "GHSA-fx6x-h9g4-56f8",
"modified": "2023-08-22T14:31:14Z",
"published": "2022-05-24T17:19:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10749"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749"
},
{
"type": "PACKAGE",
"url": "https://github.com/containernetworking/plugins"
},
{
"type": "WEB",
"url": "https://github.com/containernetworking/plugins/releases/tag/v0.8.6"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "containernetworking/plugins vulnerable to MitM attacks"
}
GHSA-G465-XM3V-VHJ4
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36
VLAI
Details
A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints.
Severity
{
"affected": [],
"aliases": [
"CVE-2017-6052"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-26T14:59:00Z",
"severity": "MODERATE"
},
"details": "A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints.",
"id": "GHSA-g465-xm3v-vhj4",
"modified": "2022-05-13T01:36:33Z",
"published": "2022-05-13T01:36:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6052"
},
{
"type": "WEB",
"url": "https://community.rapid7.com/community/infosec/blog/2017/04/25/r7-2017-02-hyundai-blue-link-potential-info-disclosure-fixed"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-115-03"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98033"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GCP8-45QV-X5W6
Vulnerability from github – Published: 2025-02-06 21:32 – Updated: 2025-02-06 21:32
VLAI
Details
2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-47258"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T20:15:39Z",
"severity": "HIGH"
},
"details": "2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices.",
"id": "GHSA-gcp8-45qv-x5w6",
"modified": "2025-02-06T21:32:09Z",
"published": "2025-02-06T21:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47258"
},
{
"type": "WEB",
"url": "https://www.2n.com/en-GB/download/cve_2024_47258_acom_3_3_v1pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H2F7-G9RH-RR7G
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-10-26 12:00
VLAI
Details
When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing a denial-of-service condition
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-32926"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-03T13:15:00Z",
"severity": "HIGH"
},
"details": "When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an illegitimate hash. The user would no longer be able to authenticate to the controller (Micro800: All versions, MicroLogix 1400: Version 21 and later) causing a denial-of-service condition",
"id": "GHSA-h2f7-g9rh-rr7g",
"modified": "2022-10-26T12:00:40Z",
"published": "2022-05-24T19:03:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32926"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-145-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HWXF-WJQ7-J3HM
Vulnerability from github – Published: 2023-12-23 15:30 – Updated: 2025-11-04 18:30
VLAI
Details
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-7008"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-23T13:15:07Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.",
"id": "GHSA-hwxf-wjq7-j3hm",
"modified": "2025-11-04T18:30:45Z",
"published": "2023-12-23T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7008"
},
{
"type": "WEB",
"url": "https://github.com/systemd/systemd/issues/25676"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2463"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3203"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-7008"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222261"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222672"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241122-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J3RQ-4XJW-XG63
Vulnerability from github – Published: 2023-12-04 23:13 – Updated: 2023-12-04 23:13
VLAI
Summary
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
Details
Impact
Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.
Patches
The issue has been patched in v1.4.0
Workarounds
Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/edgelesssys/marblerun"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-04T23:13:42Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nAny CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.\n\n### Patches\n The issue has been patched in [`v1.4.0`](https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0)\n\n### Workarounds\n\nDirectly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.\n",
"id": "GHSA-j3rq-4xjw-xg63",
"modified": "2023-12-04T23:13:42Z",
"published": "2023-12-04T23:13:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/edgelesssys/marblerun/security/advisories/GHSA-j3rq-4xjw-xg63"
},
{
"type": "PACKAGE",
"url": "https://github.com/edgelesssys/marblerun"
},
{
"type": "WEB",
"url": "https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks"
}
GHSA-J94P-GV3V-CG5Q
Vulnerability from github – Published: 2025-04-08 15:31 – Updated: 2025-04-08 15:31
VLAI
Details
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2, 6.4.0 through 6.4.8 and 6.0.0 through 6.0.12 and Fortinet FortiWeb version 7.4.0 through 7.4.2, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10 allows an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device
Severity
{
"affected": [],
"aliases": [
"CVE-2024-50565"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T14:15:31Z",
"severity": "LOW"
},
"details": "A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2, 6.4.0 through 6.4.8 and 6.0.0 through 6.0.12 and Fortinet FortiWeb version 7.4.0 through 7.4.2, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10 allows an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device",
"id": "GHSA-j94p-gv3v-cg5q",
"modified": "2025-04-08T15:31:05Z",
"published": "2025-04-08T15:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50565"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-046"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Always fully authenticate both ends of any communications channel.
Mitigation
Architecture and Design
Adhere to the principle of complete mediation.
Mitigation
Implementation
A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.
CAPEC-466: Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-589: DNS Blocking
An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.
CAPEC-590: IP Address Blocking
An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.
CAPEC-612: WiFi MAC Address Tracking
In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and changed by software). Once the attacker is able to associate a MAC address with a particular user or set of users (for example, when attending a public event), the attacker can then scan for that MAC address to track that user in the future.
CAPEC-613: WiFi SSID Tracking
In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retransmission device) as well as by clients that are accessing the network (e.g., the handset/mobile device). Once the attacker is able to associate an SSID with a particular user or set of users (for example, when attending a public event), the attacker can then scan for this SSID to track that user in the future.
CAPEC-615: Evil Twin Wi-Fi Attack
Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversary-in-the-middle" (CAPEC-94) for all communications.
CAPEC-662: Adversary in the Browser (AiTB)
An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.