Back to search
CVE-2021-34433
Published: Aug 20, 2021
Modified: Aug 4, 2024
PUBLISHED
Description
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
| Vendor | Product | Versions |
|---|---|---|
The Eclipse Foundation | Eclipse Californium | affected 2.0.0 - < unspecifiedaffected unspecified - <= 2.6.4affected 3.0.0-M1 - < unspecifiedaffected unspecified - <= 3.0.0-M3 |
Weaknesses (CWE)
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=575281
x_refsource_CONFIRM
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now