[Bug 1093273] New: CVE-2014-0363 smack: incorrect X.509 validation - java-sig-commits - Fedora Mailing-Lists

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

December

[Bug 1093273] New: CVE-2014-0363 smack: incorrect X.509 validation

[Bug 1133769] CVE-2013-7397...

[Bug 1191200] CVE-2014-0230...

Red Hat Bugzilla

Thursday, 1 May 2014 Thu, 1 May '14

1:30 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Bug ID: 1093273 Summary: CVE-2014-0363 smack: incorrect X.509 validation Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mmcallis(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it, weli(a)redhat.com Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0363 to the following vulnerability: Name: CVE-2014-0363 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0363 Assigned: 20131205 Reference: http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc... Reference: http://issues.igniterealtime.org/browse/SMACK-410 Reference: CERT-VN:VU#489228 Reference: http://www.kb.cert.org/vuls/id/489228 The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain. The man-in-the-middle attacker requires a certificate that is valid for any domain name. Upstream patch: http://fisheye.igniterealtime.org/changelog/smackgit?cs=93030c218c62cf0a0...

From code inspection, this issue affects the 3.2.2 version in Fedora (the CERT

advisory mentions version 3.4.1 and possibly earlier versions). -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1wrKeWsHiZ&a=cc_unsubscribe

Reply

Show replies by date

Red Hat Bugzilla

Thursday, 1 May Thu, 1 May

1:31 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1093274 --- Comment #1 from Murray McAllister <mmcallis(a)redhat.com> --- Created smack tracking bugs for this issue: Affects: fedora-all [bug 1093274] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1093274 [Bug 1093274] CVE-2014-0363 smack: incorrect X.509 validation [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6k8JoPLR0P&a=cc_unsubscribe

Reply

Red Hat Bugzilla

1:32 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2014-0363 smack: |CVE-2014-0363 smack: |incorrect X.509 validation |incorrect X.509 certificate | |validation -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=n8ro00R5iy&a=cc_unsubscribe

Reply

Red Hat Bugzilla

1:33 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1093275 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=G5RurQnrFv&a=cc_unsubscribe

Reply

Red Hat Bugzilla

1:53 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Arun Babu Neelicattu <aneelica(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aneelica(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wSo868eiKx&a=cc_unsubscribe

Reply

Red Hat Bugzilla

2:46 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new |ything=new,brms-6/smack=aff | |ected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ge6tjsl9s7&a=cc_unsubscribe

Reply

Red Hat Bugzilla

2:47 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected |ected,brms-5/smack=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZNw39qDizG&a=cc_unsubscribe

Reply

Red Hat Bugzilla

2:47 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected,brms-5/smack=affected |ected,bpms-6/smack=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AjW87dSAvR&a=cc_unsubscribe

Reply

Red Hat Bugzilla

2:49 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1093461 Depends On| |1093462 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=D2Mg4q2MjP&a=cc_unsubscribe

Reply

Red Hat Bugzilla

2:51 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected,bpms-6/smack=affected |ected,bpms-6/smack=affected | |,brms-5/smack=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=CVNjrI65W6&a=cc_unsubscribe

Reply

Red Hat Bugzilla

2:52 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1093469 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0TWwpqoBRR&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Sunday, 4 May Sun, 4 May

11:05 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 David Jorm <djorm(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |djorm(a)redhat.com Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cvenew,cvss2=4.3/AV:N/AC |:M/Au:N/C:N/I:P/A:N,fedora- |:M/Au:N/C:N/I:P/A:N,fedora- |all/smack=affected,jboss/an |all/smack=affected,jboss/an |ything=new,brms-6/smack=aff |ything=new,brms-6/smack=aff |ected,bpms-6/smack=affected |ected,bpms-6/smack=affected |,brms-5/smack=affected |,brms-5/smack=wontfix -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9PaYsbfzAb&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Monday, 30 June Mon, 30 Jun

1:31 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Arun Babu Neelicattu <aneelica(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1114455 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wU6hjJtJsb&a=cc_unsubscribe

Reply

Red Hat Bugzilla

3:52 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 --- Comment #6 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in following products: Via RHSA-2014:0819 https://rhn.redhat.com/errata/RHSA-2014-0819.html -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=hq85Wntb69&a=cc_unsubscribe

Reply

Red Hat Bugzilla

3:52 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 --- Comment #7 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in following products: Via RHSA-2014:0818 https://rhn.redhat.com/errata/RHSA-2014-0818.html -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=oLjhV5w2aE&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Saturday, 13 December Sat, 13 Dec

3:35 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Bug 1093273 depends on bug 1093274, which changed state. Bug 1093274 Summary: CVE-2014-0363 smack: incorrect X.509 validation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1093274 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=RJwGJm5O0A&a=cc_unsubscribe

Reply

Red Hat Bugzilla

3:35 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 --- Comment #8 from Fedora Update System <updates(a)fedoraproject.org> --- smack-3.2.2-8.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=xyDmZcVAvK&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Sunday, 14 December Sun, 14 Dec

10:30 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 --- Comment #9 from Fedora Update System <updates(a)fedoraproject.org> --- smack-3.2.2-6.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=CxDjbJ4d7d&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Wednesday, 21 January Wed, 21 Jan

12:46 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Chess Hazlett <chazlett(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alazarot(a)redhat.com, | |brms-jira(a)redhat.com, | |etirelli(a)redhat.com, | |java-sig-commits(a)lists.fedo | |raproject.org, | |lpetrovi(a)redhat.com, | |mbaluch(a)redhat.com, | |mwinkler(a)redhat.com, | |nwallace(a)redhat.com, | |pavelp(a)redhat.com, | |rrajasek(a)redhat.com, | |rzhang(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kZe6RXNop1&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Wednesday, 25 February Wed, 25 Feb

10:24 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Chess Hazlett <chazlett(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1196295 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7bbT0vWt5L&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Wednesday, 17 June Wed, 17 Jun

10:39 p.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Chess Hazlett <chazlett(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1232965 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=usJ6P1phGG&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Thursday, 18 June Thu, 18 Jun

7:32 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 --- Doc Text *updated* by Chess Hazlett <chazlett(a)redhat.com> --- It was found that the ServerTrustManager in the Smack XMPP API did not verify basicConstraints and nameConstraints in X.509 certificate chains. A man-in-the-middle attacker could use this flaw to spoof servers and obtain sensitive information. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vVCGMZoc5U&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Tuesday, 23 June Tue, 23 Jun

11:52 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 --- Comment #12 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VoTZ5IPrqA&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Friday, 31 July Fri, 31 Jul

2:19 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Ján Rusnačko <jrusnack(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0206,reported=20140430,sour |0206,reported=20140430,sour |ce=cvenew,cvss2=4.3/AV:N/AC |ce=cve,cvss2=4.3/AV:N/AC:M/ |:M/Au:N/C:N/I:P/A:N,fedora- |Au:N/C:N/I:P/A:N,fedora-all |all/smack=affected,jboss/an |/smack=affected,jboss/anyth |ything=new,brms-6/smack=aff |ing=new,brms-6/smack=affect |ected,bpms-6/smack=affected |ed,bpms-6/smack=affected,br |,brms-5/smack=wontfix,jboss |ms-5/smack=wontfix,jboss/fu |/fuse-6=affected,jboss/fuse |se-6=affected,jboss/fuse-es |-esq-7=wontfix |q-7=wontfix -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=uj24QTiQxQ&a=cc_unsubscribe

Reply

Red Hat Bugzilla

Thursday, 3 September Thu, 3 Sep

9:57 a.m.

New subject: [Bug 1093273] CVE-2014-0363 smack: incorrect X.509 certificate validation

https://bugzilla.redhat.com/show_bug.cgi?id=1093273 Chess Hazlett <chazlett(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|1196295 | -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VQVuKiKi2h&a=cc_unsubscribe _______________________________________________ java-sig-commits mailing list java-sig-commits(a)lists.fedoraproject.org http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...

Reply

3179

days inactive

3669

days old

java-sig-commits@lists.fedoraproject.org

Manage subscription

24 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla