CVE-2010-1155: Input Validation
Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1155?
CVE-2010-1155 is considered a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2010-1155?
To fix CVE-2010-1155, update Irssi to version 0.8.15 or later, where hostname matching is properly implemented.
Which versions of Irssi are affected by CVE-2010-1155?
CVE-2010-1155 affects all Irssi versions prior to 0.8.15, including versions 0.8.0 to 0.8.14.
What kind of attack can occur because of CVE-2010-1155?
CVE-2010-1155 allows attackers to spoof IRC servers, enabling man-in-the-middle attacks that compromise secure communications.
Is SSL secure in Irssi versions affected by CVE-2010-1155?
In affected versions of Irssi, SSL is not secure due to the lack of hostname verification, making it vulnerable to attacks.