CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1917 vulnerabilities reference this CWE, most recent first.
GHSA-7H6J-6653-FX8C
Vulnerability from github – Published: 2022-12-22 21:30 – Updated: 2025-04-16 18:31After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
{
"affected": [],
"aliases": [
"CVE-2022-22747"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-22T20:15:00Z",
"severity": "MODERATE"
},
"details": "After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR \u003c 91.5, Firefox \u003c 96, and Thunderbird \u003c 91.5.",
"id": "GHSA-7h6j-6653-fx8c",
"modified": "2025-04-16T18:31:36Z",
"published": "2022-12-22T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22747"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735028"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-01"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-02"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HF4-2CMF-XPCC
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incomplete input validation of the client EAP-TLS certificate. An attacker could exploit this vulnerability by initiating EAP authentication over TLS to the ISE with a crafted EAP-TLS certificate. A successful exploit could allow the attacker to restart the ISE application server, resulting in a DoS condition on the affected system. The ISE application could continue to restart while the client attempts to establish the EAP authentication connection. If an attacker attempted to import the same EAP-TLS certificate to the ISE trust store, it could trigger a DoS condition on the affected system. This exploit vector would require the attacker to have valid administrator credentials. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance. Cisco Bug IDs: CSCve31857.
{
"affected": [],
"aliases": [
"CVE-2018-0277"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-17T03:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incomplete input validation of the client EAP-TLS certificate. An attacker could exploit this vulnerability by initiating EAP authentication over TLS to the ISE with a crafted EAP-TLS certificate. A successful exploit could allow the attacker to restart the ISE application server, resulting in a DoS condition on the affected system. The ISE application could continue to restart while the client attempts to establish the EAP authentication connection. If an attacker attempted to import the same EAP-TLS certificate to the ISE trust store, it could trigger a DoS condition on the affected system. This exploit vector would require the attacker to have valid administrator credentials. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance. Cisco Bug IDs: CSCve31857.",
"id": "GHSA-7hf4-2cmf-xpcc",
"modified": "2022-05-13T01:35:29Z",
"published": "2022-05-13T01:35:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0277"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-iseeap"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104212"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040922"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HFW-R8QC-89V4
Vulnerability from github – Published: 2026-03-07 00:30 – Updated: 2026-07-21 12:32When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
{
"affected": [],
"aliases": [
"CVE-2026-27137"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-06T22:16:00Z",
"severity": "HIGH"
},
"details": "When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"id": "GHSA-7hfw-r8qc-89v4",
"modified": "2026-07-21T12:32:40Z",
"published": "2026-03-07T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28047"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:29854"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41019"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41928"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5110"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7291"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8151"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8167"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8337"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8338"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8842"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9052"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9697"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9698"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9699"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"type": "WEB",
"url": "https://go.dev/cl/752182"
},
{
"type": "WEB",
"url": "https://go.dev/issue/77952"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10125"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10158"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10169"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10184"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10225"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10250"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10929"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11800"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14879"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19022"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19132"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19181"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21769"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22347"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7HHJ-8FWV-M5HC
Vulnerability from github – Published: 2026-05-27 00:31 – Updated: 2026-07-22 18:31A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
{
"affected": [],
"aliases": [
"CVE-2026-42012"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-26T22:16:41Z",
"severity": "HIGH"
},
"details": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.",
"id": "GHSA-7hhj-8fwv-m5hc",
"modified": "2026-07-22T18:31:46Z",
"published": "2026-05-27T00:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012"
},
{
"type": "WEB",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-42012"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:43575"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41921"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33125"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:32962"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30850"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30849"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30004"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26409"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26319"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20613"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20612"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20611"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13274"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7HQ7-5M7P-R2PP
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.
This issue was fixed in version 463.
{
"affected": [],
"aliases": [
"CVE-2026-9058"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-393"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-25T14:16:27Z",
"severity": "CRITICAL"
},
"details": "Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, \"Positively verified\") even when the trust status of the signer\u0027s certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == \"nondetermined\"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.\n\nThis issue was fixed in version 463.",
"id": "GHSA-7hq7-5m7p-r2pp",
"modified": "2026-05-26T13:30:42Z",
"published": "2026-05-26T13:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9058"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/05/CVE-2026-9058"
},
{
"type": "WEB",
"url": "https://www.elektronicznypodpis.pl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7JH7-FP3W-72G5
Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2024-04-04 01:13Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification. Keys that are obviously invalid are not rejected during import. An attacker that is able to get a victim to import a manipulated key could claim to have signed a message that originates from another person.
{
"affected": [],
"aliases": [
"CVE-2019-9148"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-09T21:15:00Z",
"severity": "MODERATE"
},
"details": "Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification. Keys that are obviously invalid are not rejected during import. An attacker that is able to get a victim to import a manipulated key could claim to have signed a message that originates from another person.",
"id": "GHSA-7jh7-fp3w-72g5",
"modified": "2024-04-04T01:13:34Z",
"published": "2022-05-24T16:49:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9148"
},
{
"type": "WEB",
"url": "https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330"
},
{
"type": "WEB",
"url": "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html"
},
{
"type": "WEB",
"url": "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile\u0026v=3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7JRQ-Q4PQ-RHM6
Vulnerability from github – Published: 2026-04-14 23:15 – Updated: 2026-04-24 20:39Summary
The trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS.
Impact
In deployments using mTLS with certificate chains (intermediate CA + root CA bundles), legitimate clients with properly chained certificates are rejected with x509: certificate signed by unknown authority. This degrades the security posture by making mTLS unusable with standard CA chain configurations, potentially forcing operators to disable client certificate verification.
All versions using TLS with trustedCaFile configuration are affected.
Details
In common/security/tls.go, the trustedCertPool() method calls pem.Decode() only once, processing a single PEM block. The remaining bytes (containing additional certificates) are silently discarded. Additionally, the error return from pem.Decode is ignored, so a corrupted CA file results in an empty certificate pool without any error.
Patches
Fixed by iterating over all PEM blocks in the file, parsing each CERTIFICATE block, and returning an error if no valid certificates are found.
Workarounds
Use CA files containing only a single certificate (the direct issuer of client certificates, not a chain).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.16.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/oxia-db/oxia"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40944"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T23:15:16Z",
"nvd_published_at": "2026-04-21T22:16:19Z",
"severity": "HIGH"
},
"details": "### Summary\nThe `trustedCertPool()` function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS.\n\n### Impact\nIn deployments using mTLS with certificate chains (intermediate CA + root CA bundles), legitimate clients with properly chained certificates are rejected with `x509: certificate signed by unknown authority`. This degrades the security posture by making mTLS unusable with standard CA chain configurations, potentially forcing operators to disable client certificate verification.\n\nAll versions using TLS with `trustedCaFile` configuration are affected.\n\n### Details\nIn `common/security/tls.go`, the `trustedCertPool()` method calls `pem.Decode()` only once, processing a single PEM block. The remaining bytes (containing additional certificates) are silently discarded. Additionally, the error return from `pem.Decode` is ignored, so a corrupted CA file results in an empty certificate pool without any error.\n\n### Patches\nFixed by iterating over all PEM blocks in the file, parsing each CERTIFICATE block, and returning an error if no valid certificates are found.\n\n### Workarounds\nUse CA files containing only a single certificate (the direct issuer of client certificates, not a chain).",
"id": "GHSA-7jrq-q4pq-rhm6",
"modified": "2026-04-24T20:39:58Z",
"published": "2026-04-14T23:15:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oxia-db/oxia/security/advisories/GHSA-7jrq-q4pq-rhm6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40944"
},
{
"type": "PACKAGE",
"url": "https://github.com/oxia-db/oxia"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Oxia\u0027s TLS CA certificate chain validation fails with multi-certificate PEM bundles"
}
GHSA-7JVQ-HRP2-XM5C
Vulnerability from github – Published: 2023-02-11 03:32 – Updated: 2023-02-21 18:30Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could potentially exploit this vulnerability, leading to credential theft and/or denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-34404"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-11T01:23:00Z",
"severity": "MODERATE"
},
"details": "Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could potentially exploit this vulnerability, leading to credential theft and/or denial of service.",
"id": "GHSA-7jvq-hrp2-xm5c",
"modified": "2023-02-21T18:30:24Z",
"published": "2023-02-11T03:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34404"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/000203733"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7M3H-2VJR-JJ8G
Vulnerability from github – Published: 2022-05-17 02:39 – Updated: 2025-04-20 03:39The "JMCU Mobile Banking" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-9579"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T12:29:00Z",
"severity": "MODERATE"
},
"details": "The \"JMCU Mobile Banking\" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-7m3h-2vjr-jj8g",
"modified": "2025-04-20T03:39:13Z",
"published": "2022-05-17T02:39:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9579"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7MFR-774F-W5R9
Vulnerability from github – Published: 2022-04-12 00:07 – Updated: 2022-04-12 00:07.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "System.Security.Cryptography.X509Certificates"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.NETCore.App"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-11770"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-12T00:07:34Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": ".NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka \".NET CORE Denial Of Service Vulnerability\".",
"id": "GHSA-7mfr-774f-w5r9",
"modified": "2022-04-12T00:07:34Z",
"published": "2022-04-12T00:07:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11770"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:3248"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11770"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101710"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039787"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Certificate Validation"
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.