MEDIUM
libgadu: missing ssl certificate validation
Published Oct 10, 2014
4.3
MEDIUMCVSS 2.0
EPSS 1.11%
Description
libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.
Affected products
Remediation
No remediation recorded yet.
Weaknesses (2)
References (11)
- http://www.mail-archive.com/libgadu-devel%40lists.ziew.org/msg01017.html mailing-listx_refsource_MLIST
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:185 vendor-advisoryx_refsource_MANDRIVA
- http://www.openwall.com/lists/oss-security/2013/10/31/5 mailing-listx_refsource_MLIST
- http://www.securityfocus.com/bid/63473 vdb-entryx_refsource_BID
- https://access.redhat.com/security/cve/CVE-2013-4488 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1025718 x_refsource_CONFIRMIssue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-4353 Advisory
- https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125143.html vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2013-4488
- https://security.gentoo.org/glsa/201508-02 vendor-advisoryx_refsource_GENTOO
- https://www.cve.org/CVERecord?id=CVE-2013-4488
| Link | Providers | Tags |
|---|---|---|
| http://www.mail-archive.com/libgadu-devel%40lists.ziew.org/msg01017.html | mailing-listx_refsource_MLIST | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:185 | vendor-advisoryx_refsource_MANDRIVA | |
| http://www.openwall.com/lists/oss-security/2013/10/31/5 | mailing-listx_refsource_MLIST | |
| http://www.securityfocus.com/bid/63473 | vdb-entryx_refsource_BID | |
| https://access.redhat.com/security/cve/CVE-2013-4488 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1025718 | x_refsource_CONFIRMIssue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-4353 | Advisory | |
| https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125143.html | vendor-advisoryx_refsource_FEDORA | |
| https://nvd.nist.gov/vuln/detail/CVE-2013-4488 | ||
| https://security.gentoo.org/glsa/201508-02 | vendor-advisoryx_refsource_GENTOO | |
| https://www.cve.org/CVERecord?id=CVE-2013-4488 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Oct 10, 2014
Updated Aug 6, 2024
Reserved Jun 12, 2013
Link CVE-2013-4488
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2013-4353 Assigner redhat
Published Oct 10, 2014
Updated Aug 6, 2024
Exploited since n/a
Link EUVD-2013-4353