CVE-2012-5814: Input Validation
Weberknecht, as used in GitHub Gaug.es and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5814?
CVE-2012-5814 has a severity rating that varies depending on the context and environment but is generally considered a significant risk due to the potential for man-in-the-middle attacks.
How do I fix CVE-2012-5814?
To fix CVE-2012-5814, ensure that your software properly validates the server hostname against the Common Name or subjectAltName field in the SSL certificate.
Which software is affected by CVE-2012-5814?
CVE-2012-5814 affects GitHub Gaug.es and Roderick Baier's Weberknecht implementation.
What are the implications of not addressing CVE-2012-5814?
Not addressing CVE-2012-5814 can lead to vulnerability to man-in-the-middle attacks, allowing attackers to spoof SSL servers.
Is there a workaround for CVE-2012-5814?
A possible workaround for CVE-2012-5814 is to review and restrict the use of SSL connections until the underlying software can be updated to include hostname verification.