CVE-2014-3604
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit likelihood
What each source reports
NVD Score used
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2014-3604- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2014-3604- Updated
- 2026-11-02
EUVDEUVD-2022-3600 No score
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
EUVD-2022-3600- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cmxj-wx9v-52qr No score
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-cmxj-wx9v-52qr- Weakness
- CWE-297
- Updated
- 2026-11-02
OSVGHSA-cmxj-wx9v-52qr No score
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-cmxj-wx9v-52qr- Weakness
- CWE-297
- Updated
- 2026-11-02
OSVMGASA-2014-0551 No score
Updated not-yet-commons-ssl packages fix CVE-2014-3604
Updated not-yet-commons-ssl packages fixes security vulnerability:
It was discovered that the implementation used by the Not Yet Commons SSL project to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject (CVE-2014-3604).
- Record
MGASA-2014-0551- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3604 No score
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
UBUNTU-CVE-2014-3604- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ca.juliusdavies:not-yet-commons-sslMaven |
before 0.3.15 | 0.3.15 |
ca.juliusdavies:not-yet-commons-sslMaven |
before 0.3.15, plus listed versions 0.3.110.3.9 |
0.3.15 |
not-yet-commons-sslMageia:4 |
before 0.3.15-1.mga4 | 0.3.15-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3604 is a medium vulnerability (CVSS 6.8) in Not Yet Commons Ssl Project Yet Commons Ssl, published October 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in ca.juliusdavies:not-yet-commons-ssl 0.3.15.
References
juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev&revision=172
exchange.xforce.ibmcloud.com/vulnerabilities/97659
rhn.redhat.com/errata/RHSA-2015-1888.html
bugzilla.redhat.com/show_bug.cgi?id=1131803
github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml
nvd.nist.gov/vuln/detail/CVE-2014-3604
Show 7 moreShow less
advisories.mageia.org/MGASA-2014-0551.html
bugs.mageia.org/show_bug.cgi?id=14175
lists.fedoraproject.org/pipermail/package-announce/2014-September/138550.html
ubuntu.com/security/CVE-2014-3604
lists.juliusdavies.ca/pipermail/not-yet-commons-ssl-juliusdavies.ca/2014-August/000832.html
cve.org/CVERecord?id=CVE-2014-3604