Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00aHh2LTk1cmMtanFnN84AAYEq

nv-websocket-client allows attackers to spoof SSL/TLS servers via an arbitrary valid certificate

The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.

Permalink: https://github.com/advisories/GHSA-4hxv-95rc-jqg7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00aHh2LTk1cmMtanFnN84AAYEq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

CVSS Score: 5.9
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-4hxv-95rc-jqg7, CVE-2017-1000209
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000209
• https://github.com/TakahikoKawasaki/nv-websocket-client/pull/107
• https://github.com/advisories/GHSA-4hxv-95rc-jqg7

Repository: https://github.com/TakahikoKawasaki/nv-websocket-client
Blast Radius: 15.2

Affected Packages