CVE-2004-2393: High severity Sun JSSE vulnerability
Java Secure Socket Extension (JSSE) 1.0.3 through 1.0.32 does not properly validate the certificate chain of a client or server, which allows remote attackers to falsely authenticate peers for SSL/TLS.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2393?
CVE-2004-2393 has been rated as critical due to its potential to allow remote attackers to falsely authenticate SSL/TLS connections.
How do I fix CVE-2004-2393?
To fix CVE-2004-2393, upgrade to a later version of the Java Secure Socket Extension (JSSE) that includes the necessary certificate chain validation improvements.
What versions of JSSE are affected by CVE-2004-2393?
CVE-2004-2393 affects Sun JSSE versions 1.0.3, 1.0.3_01, and 1.0.3_02.
What type of attacks can CVE-2004-2393 enable?
CVE-2004-2393 can enable remote attackers to perform man-in-the-middle attacks by falsely authenticating peers.
Is CVE-2004-2393 related to SSL/TLS security?
Yes, CVE-2004-2393 is specifically related to SSL/TLS security and the validation of certificate chains in these protocols.