Skip to content
OpenAdvisories
Unscored CVE-2014-0363 EUVD-2014-0401GHSA-444r-2xr3-rxhv

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraint…

Published Apr 30, 2014 · Updated Aug 6, 2024 · Assigned by certcc

Description

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

References