CVE-2011-3422
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an...
CVE-2011-3422 is a medium vulnerability (CVSS 4.3) in Apple Mac Os X, published September 10, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. No source names a fixed version.
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
Exploit likelihood
What each source reports
NVD Score used
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
- Record
CVE-2011-3422- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
- Record
CVE-2011-3422- Updated
- 2026-11-02
EUVDEUVD-2011-3385 No score
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
- Record
EUVD-2011-3385- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jf47-vrx5-85qc No score
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an...
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
- Record
GHSA-jf47-vrx5-85qc- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
securityfocus.com/bid/49429
support.apple.com/kb/HT5130
securitytracker.com/id?1026002
computerworld.com/s/article/9219669/Mac_OS_X_can_t_properly_revoke_dodgy_digital_certificates
lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
exchange.xforce.ibmcloud.com/vulnerabilities/69556
nvd.nist.gov/vuln/detail/CVE-2011-3422
github.com/advisories/GHSA-jf47-vrx5-85qc