Improper certificate validation in Szafir
概要
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| Krajowa Izba Rozliczeniowa | Szafir |
2.0 以前 |
— |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
出典: CVE.org (CVE Program・cvelistV5) NVD
参照URL
- web cvd@cert.pl
- web cvd@cert.pl