CVE-2014-3504: Medium severity subversion vulnerability
The (1) serfsslcertissuer, (2) serfsslcertsubject, and (3) serfsslcertcertificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3504?
CVE-2014-3504 has been rated as a medium severity vulnerability due to its potential for man-in-the-middle attack.
How do I fix CVE-2014-3504?
To fix CVE-2014-3504, update the Serf library to version 1.3.7 or later.
What software is affected by CVE-2014-3504?
CVE-2014-3504 affects Serf versions 0.2.0 through 1.3.x before 1.3.7, along with specific versions of Apache Subversion.
What kind of attack does CVE-2014-3504 facilitate?
CVE-2014-3504 allows man-in-the-middle attackers to exploit improper handling of NUL bytes in domain names.
Can using affected versions of Serf expose my system to risks?
Yes, using affected versions of Serf can expose your system to man-in-the-middle attacks, risking data interception.