CVE-2014-3504
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate...
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Exploit likelihood
What each source reports
NVD Score used
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
CVE-2014-3504- CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
CVE-2014-3504- Updated
- 2026-11-02
EUVDEUVD-2014-3505 No score
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
EUVD-2014-3505- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4425-mwr9-99xc No score
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate...
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
GHSA-4425-mwr9-99xc- Updated
- 2026-11-02
OSVBELL-CVE-2014-3504
CVE-2014-3504 does not affect BellSoft software
- Record
BELL-CVE-2014-3504- CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
OSV No score
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
CVE-2014-3504- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-3504 No score
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
DEBIAN-CVE-2014-3504- Updated
- 2026-11-02
OSVMGASA-2014-0353 No score
Updated serf packages fix CVE-2014-3504
Updated serf packages fix security vulnerability:
Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2014-3504).
- Record
MGASA-2014-0353- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10569-1 No score
libserf-1-1-1.3.9-1.2 on GA media
These are all security issues fixed in the libserf-1-1-1.3.9-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10569-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3504 No score
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
- Record
UBUNTU-CVE-2014-3504- Updated
- 2026-11-02
OSVUSN-2315-1 No score
serf vulnerability
Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications.
- Record
USN-2315-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
serfDebian:12 |
before 1.3.7-1 | 1.3.7-1 |
serfDebian:13 |
before 1.3.7-1 | 1.3.7-1 |
serfDebian:14 |
before 1.3.7-1 | 1.3.7-1 |
serfMageia:3 |
before 1.1.1-2.1.mga3 | 1.1.1-2.1.mga3 |
serfMageia:4 |
before 1.3.2-2.1.mga4 | 1.3.2-2.1.mga4 |
serfUbuntu:14.04:LTS |
before 1.3.3-1ubuntu0.1, plus listed versions 1.1.0-2ubuntu11.3.3-1 |
1.3.3-1ubuntu0.1 |
libserfopenSUSE:Tumbleweed |
before 1.3.9-1.2 | 1.3.9-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3504 is a medium vulnerability (CVSS 4.0) in Serf Project Serf, published August 12, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.15%, the 88th percentile. Fixed in serf 1.3.7-1.
References
ubuntu.com/usn/usn-2315-1
securityfocus.com/bid/69238
secunia.com/advisories/60721
subversion.apache.org/security/CVE-2014-3522-advisory.txt
groups.google.com/forum
lists.opensuse.org/opensuse-updates/2014-08/msg00038.html
Show 13 moreShow less
security.gentoo.org/glsa/201610-05
oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
nvd.nist.gov/vuln/detail/CVE-2014-3504
github.com/advisories/GHSA-4425-mwr9-99xc
docs.bell-sw.com/security/cves/CVE-2014-3504
security-tracker.debian.org/tracker/CVE-2014-3504
advisories.mageia.org/MGASA-2014-0353.html
bugs.mageia.org/show_bug.cgi?id=13914
cve.org/CVERecord?id=CVE-2014-3504
suse.com/security/cve/CVE-2014-3504