{"id":"CVE-2014-3604","aliases":["EUVD-2022-3600","GHSA-cmxj-wx9v-52qr","MGASA-2014-0551","UBUNTU-CVE-2014-3604"],"status":"published","title":"Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0094,"percentile":0.61169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-297","CWE-310"],"published":"2014-10-25T00:00:00Z","modified":"2026-06-17T00:08:36Z","fixes":[{"ecosystem":"Maven","package":"ca.juliusdavies:not-yet-commons-ssl","fixed_in":["0.3.15"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:4","package":"not-yet-commons-ssl","fixed_in":["0.3.15-1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"ca.juliusdavies:not-yet-commons-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.15"}]}]},{"source":"osv","ecosystem":"Maven","package":"ca.juliusdavies:not-yet-commons-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.15"}]}],"versions":["0.3.11","0.3.9"]},{"source":"osv","ecosystem":"Mageia:4","package":"not-yet-commons-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.15-1.mga4"}]}]}],"products":[{"vendor":"not_yet_commons_ssl_project","product":"not_yet_commons_ssl"}],"references":[{"url":"http://juliusdavies.ca/svn/viewvc.cgi/not-yet-commons-ssl?view=rev\u0026revision=172","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/97659","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1888.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1131803","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3604.yaml","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cmxj-wx9v-52qr"},{"url":"https://advisories.mageia.org/MGASA-2014-0551.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14175","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-September/138550.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3604","tags":["report"]},{"url":"http://lists.juliusdavies.ca/pipermail/not-yet-commons-ssl-juliusdavies.ca/2014-August/000832.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3604","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3604","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-10-25T00:00:00Z","modified":"2024-08-06T10:50:17.76Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2022-3600","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-10-25T00:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-cmxj-wx9v-52qr","title":"Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2022-05-14T03:59:54Z","modified":"2023-01-27T05:02:21Z","cwes":["CWE-297"],"updated_at":"2026-11-02T14:36:17.742171Z"}],"nvd":[{"id":"CVE-2014-3604","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2014-10-25T00:55:03.023Z","modified":"2026-06-17T00:08:36.35Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:56.921017Z"}],"osv":[{"id":"GHSA-cmxj-wx9v-52qr","title":"Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"published","published":"2022-05-14T03:59:54Z","modified":"2024-12-05T05:56:56.068602Z","cwes":["CWE-297"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"MGASA-2014-0551","title":"Updated not-yet-commons-ssl packages fix CVE-2014-3604","description":"Updated not-yet-commons-ssl packages fixes security vulnerability:\n\nIt was discovered that the implementation used by the Not Yet Commons SSL\nproject to check that the server hostname matches the domain name in the\nsubject's CN field was flawed. This can be exploited by a Man-in-the-middle\n(MITM) attack, where the attacker can spoof a valid certificate using a\nspecially crafted subject (CVE-2014-3604).\n","status":"published","published":"2014-12-26T17:04:58Z","modified":"2026-04-16T06:24:23.650127534Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-3604","description":"Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","status":"withdrawn","published":"2014-10-25T00:55:00Z","modified":"2025-07-16T07:17:17.081479Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}