Unscored CVE-2003-1229 EUVD-2003-1219GHSA-8f8h-rq9j-vxqg

X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in …

Published Aug 17, 2005 · Updated Aug 8, 2024 · Assigned by mitre

Description

X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.

References

1006001 vdb-entry
1007483 vdb-entry
1006007 vdb-entry
http://java.sun.com/products/jsse/CHANGES.txt
HPSBUX0301-239 vendor-advisory
sun-java-improper-validation(11182) vdb-entry
7943 third-party-advisory
6682 vdb-entry
oval:org.mitre.oval:def:5883 vdb-entry signature
50081 vendor-advisory
20030128 Incorrect Certificate Validation in Java Secure Socket Extension mailing-list