CVE-2012-5799: Input Validation
The Canada Post (aka CanadaPost) module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5799?
CVE-2012-5799 is classified as a medium severity vulnerability.
How do I fix CVE-2012-5799?
To fix CVE-2012-5799, ensure that the Canada Post module is updated to the latest version that implements proper SSL hostname verification.
What types of attacks can exploit CVE-2012-5799?
CVE-2012-5799 can be exploited by man-in-the-middle attackers who can spoof SSL servers using valid certificates.
Which versions of PrestaShop are affected by CVE-2012-5799?
CVE-2012-5799 affects all versions of PrestaShop that include the vulnerable Canada Post module.
Is CVE-2012-5799 a critical vulnerability?
CVE-2012-5799 is not categorized as critical but poses risks to data security and integrity.