Unscored CVE-2014-2845 EUVD-2014-2870GHSA-9555-fvr7-fm2h

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FT…

Published Nov 15, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Description

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority.

References

https://cyberduck.io/changelog/
20140506 CVE-2014-2845 - Cyberduck (Windows): Failure validating some certificates (using FTP-SSL) with untrusted root certificate authority mailing-list
58426 third-party-advisory