From 54ce08cc3a5e849ce1c326ea20a77d6381dd2bcc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 1 Mar 2024 20:31:26 +0000 Subject: [PATCH] Publish GHSA-r53v-vm87-f72c --- .../GHSA-r53v-vm87-f72c.json | 23 +++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2018/10/GHSA-r53v-vm87-f72c/GHSA-r53v-vm87-f72c.json b/advisories/github-reviewed/2018/10/GHSA-r53v-vm87-f72c/GHSA-r53v-vm87-f72c.json index c59420b8282..3818a357413 100644 --- a/advisories/github-reviewed/2018/10/GHSA-r53v-vm87-f72c/GHSA-r53v-vm87-f72c.json +++ b/advisories/github-reviewed/2018/10/GHSA-r53v-vm87-f72c/GHSA-r53v-vm87-f72c.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r53v-vm87-f72c", - "modified": "2023-02-15T22:10:09Z", + "modified": "2024-03-01T20:29:59Z", "published": "2018-10-16T20:50:58Z", "aliases": [ "CVE-2014-3596" ], - "summary": "Moderate severity vulnerability that affects org.apache.axis:axis", + "summary": "Improper Validation of Certificates in apache axis", "details": "The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.", "severity": [ @@ -30,6 +30,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "axis:axis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.4" + } + ] + } + ] } ], "references": [