Summary
Ben Reser discovered that serf did not correctly handle SSL certificates
with NUL bytes in the CommonName or SubjectAltNames fields. A remote
attacker could exploit this to perform a machine-in-the-middle attack to view
sensitive information or alter encrypted communications.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | serf | 1.3.3-1ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 thro…
References
-
report
https://ubuntu.com/security/CVE-2014-3504