CVE-2003-1229
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01...
CVE-2003-1229 is a high vulnerability (CVSS 7.5) in Oracle Jre, published December 31, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.63%, the 91st percentile. No source names a fixed version.
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
Exploit likelihood
What each source reports
NVD Score used
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
- Record
CVE-2003-1229- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
- Record
CVE-2003-1229- Updated
- 2026-11-02
EUVDEUVD-2003-1219 No score
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
- Record
EUVD-2003-1219- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8f8h-rq9j-vxqg No score
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01...
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
- Record
GHSA-8f8h-rq9j-vxqg- Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
securitytracker.com/id?1006001
securitytracker.com/id?1007483
java.sun.com/products/jsse/CHANGES.txt
www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0301-239
exchange.xforce.ibmcloud.com/vulnerabilities/11182
Show 7 moreShow less
secunia.com/advisories/7943
securityfocus.com/bid/6682
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5883
sunsolve.sun.com/search/document.do?assetkey=1-26-50081-1
archives.neohapsis.com/archives/bugtraq/2003-01/0334.html
nvd.nist.gov/vuln/detail/CVE-2003-1229
github.com/advisories/GHSA-8f8h-rq9j-vxqg