CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1919 vulnerabilities reference this CWE, most recent first.
GHSA-9WMF-VW9Q-PC64
Vulnerability from github – Published: 2023-02-16 18:30 – Updated: 2023-02-27 18:32It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack.
{
"affected": [],
"aliases": [
"CVE-2022-48307"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-16T16:15:00Z",
"severity": "LOW"
},
"details": "It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack.",
"id": "GHSA-9wmf-vw9q-pc64",
"modified": "2023-02-27T18:32:01Z",
"published": "2023-02-16T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48307"
},
{
"type": "WEB",
"url": "https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-13.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WXP-W4PX-32VH
Vulnerability from github – Published: 2026-06-11 09:31 – Updated: 2026-06-11 09:31Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
{
"affected": [],
"aliases": [
"CVE-2026-40992"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-11T07:16:27Z",
"severity": "MODERATE"
},
"details": "Spring Boot\u0027s Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.",
"id": "GHSA-9wxp-w4px-32vh",
"modified": "2026-06-11T09:31:55Z",
"published": "2026-06-11T09:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40992"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-40992"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9X39-G9G5-P55P
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49Improper certificate validation in Platform Sample/ Silicon Reference firmware for 8th Generation Intel(R) Core(tm) Processor, 7th Generation Intel(R) Core(tm) Processor may allow an unauthenticated user to potentially enable an escalation of privilege via physical access.
{
"affected": [],
"aliases": [
"CVE-2018-12205"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-14T20:29:00Z",
"severity": "HIGH"
},
"details": "Improper certificate validation in Platform Sample/ Silicon Reference firmware for 8th Generation Intel(R) Core(tm) Processor, 7th Generation Intel(R) Core(tm) Processor may allow an unauthenticated user to potentially enable an escalation of privilege via physical access.",
"id": "GHSA-9x39-g9g5-p55p",
"modified": "2022-05-13T01:49:31Z",
"published": "2022-05-13T01:49:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12205"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190318-0002"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03912en_us"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00191.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9X5C-G8WH-RGRW
Vulnerability from github – Published: 2026-01-23 18:31 – Updated: 2026-01-23 21:30An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.
{
"affected": [],
"aliases": [
"CVE-2025-67229"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-23T17:16:07Z",
"severity": "CRITICAL"
},
"details": "An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.",
"id": "GHSA-9x5c-g8wh-rgrw",
"modified": "2026-01-23T21:30:43Z",
"published": "2026-01-23T18:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67229"
},
{
"type": "WEB",
"url": "https://www.todesktop.com/changelog"
},
{
"type": "WEB",
"url": "https://www.todesktop.com/security/advisories/TDSA-2025-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9X6C-8Q9J-869J
Vulnerability from github – Published: 2022-05-17 01:09 – Updated: 2022-05-17 01:09Honda Moto LINC 1.6.1 does not verify SSL certificates.
{
"affected": [],
"aliases": [
"CVE-2015-2943"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-06T21:29:00Z",
"severity": "MODERATE"
},
"details": "Honda Moto LINC 1.6.1 does not verify SSL certificates.",
"id": "GHSA-9x6c-8q9j-869j",
"modified": "2022-05-17T01:09:33Z",
"published": "2022-05-17T01:09:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2943"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN75851252/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000065.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9XMR-C663-3RPR
Vulnerability from github – Published: 2026-04-10 00:30 – Updated: 2026-07-02 15:31URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.
{
"affected": [],
"aliases": [
"CVE-2026-5263"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-09T22:16:36Z",
"severity": "HIGH"
},
"details": "URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.",
"id": "GHSA-9xmr-c663-3rpr",
"modified": "2026-07-02T15:31:56Z",
"published": "2026-04-10T00:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5263"
},
{
"type": "WEB",
"url": "https://github.com/wolfSSL/wolfssl/pull/10048"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9XMV-X9P2-VRMQ
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the ssl_ca parameter but do not specify the ssl_certs_dir parameter, a default will be provided for the ssl_certs_dir that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.
{
"affected": [],
"aliases": [
"CVE-2017-2299"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-15T18:29:00Z",
"severity": "HIGH"
},
"details": "Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.",
"id": "GHSA-9xmv-x9p2-vrmq",
"modified": "2022-05-13T01:44:43Z",
"published": "2022-05-13T01:44:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2299"
},
{
"type": "WEB",
"url": "https://puppet.com/security/cve/CVE-2017-2299"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100859"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2F9-W3C5-X385
Vulnerability from github – Published: 2022-05-02 03:35 – Updated: 2025-03-27 15:30The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
{
"affected": [],
"aliases": [
"CVE-2009-2409"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-07-30T19:30:00Z",
"severity": "MODERATE"
},
"details": "The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.",
"id": "GHSA-c2f9-w3c5-x385",
"modified": "2025-03-27T15:30:34Z",
"published": "2022-05-02T03:35:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2409"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2409"
},
{
"type": "WEB",
"url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html"
},
{
"type": "WEB",
"url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10763"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6631"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7155"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8594"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/810-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2009/dsa-1888"
},
{
"type": "WEB",
"url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
},
{
"type": "WEB",
"url": "http://java.sun.com/javase/6/webnotes/6u17.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36139"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36157"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36434"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36669"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36739"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37386"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42467"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200912-01.xml"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3937"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1874"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:197"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:216"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:258"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1207.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1432.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/515055/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1022631"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-810-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2010-0019.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/2085"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3184"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3126"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-C2V8-3552-RP4M
Vulnerability from github – Published: 2023-04-29 00:30 – Updated: 2024-04-04 03:44GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.
{
"affected": [],
"aliases": [
"CVE-2023-31485"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-29T00:15:09Z",
"severity": "MODERATE"
},
"details": "GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.",
"id": "GHSA-c2v8-3552-rp4m",
"modified": "2024-04-04T03:44:28Z",
"published": "2023-04-29T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31485"
},
{
"type": "WEB",
"url": "https://github.com/bluefeet/GitLab-API-v4/pull/57"
},
{
"type": "WEB",
"url": "https://github.com/chansen/p5-http-tiny/pull/151"
},
{
"type": "WEB",
"url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/04/18/14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/04/29/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/07/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2VG-Q78P-66VP
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.
{
"affected": [],
"aliases": [
"CVE-2017-7513"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-22T15:29:00Z",
"severity": "MODERATE"
},
"details": "It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host name fields. A man-in-the-middle attacker could use this flaw to spoof a PostgreSQL server using a specially crafted X.509 certificate.",
"id": "GHSA-c2vg-q78p-66vp",
"modified": "2022-05-13T01:36:19Z",
"published": "2022-05-13T01:36:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7513"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2017-7513"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7513"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.