MGASA-2015-0050
Updated hexchat packages fix security vulnerability
HexChat did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.
What each source reports
OSV No score
Updated hexchat packages fix security vulnerability
HexChat did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.
- Record
MGASA-2015-0050- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hexchatMageia:4 |
before 2.9.6.1-3.1.mga4 | 2.9.6.1-3.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2015-0050 is a vulnerability with no CVSS score yet in hexchat, published February 5, 2015. No source lists public exploit code. Fixed in hexchat 2.9.6.1-3.1.mga4.