CWE-295

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "python-swiftclient"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-6396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T18:56:11Z",
    "nvd_published_at": "2014-02-18T19:55:00Z",
    "severity": "CRITICAL"
  },
  "details": "The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-p3xv-97g8-4wmj",
  "modified": "2025-07-07T12:57:06Z",
  "published": "2022-05-17T04:52:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6396"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openstack/python-swiftclient/commit/b182112719ab87942472e44aa3446ea0eb19a289"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/python-swiftclient/+bug/1199783"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/chmouel/python-swiftclient"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/python-swiftclient/PYSEC-2014-12.yaml"
    },
    {
      "type": "WEB",
      "url": "https://review.opendev.org/c/openstack/python-swiftclient/+/69187"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/02/17/7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Python Swift client is vulnerable to Missing SSL Certificate Check"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-13645"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-05-28T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server\u0027s TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.",
  "id": "GHSA-p43h-5x4h-9pp7",
  "modified": "2022-05-24T17:18:48Z",
  "published": "2022-05-24T17:18:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13645"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/balsa/-/issues/34"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/glib-networking/-/issues/135"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLEX2IP62SU6WJ4SK3U766XGLQK3J62O"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LRCUM22YEWWKNMN2BP5LTVDM5P4VWIXS"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQEQJQ4XFMFCFJTEXKL2ZO3UELBPCKSK"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202007-50"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20200608-0004"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4405-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T16:15:38Z",
    "severity": "MODERATE"
  },
  "details": "When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134 and Firefox ESR \u003c 128.6.",
  "id": "GHSA-p4q7-g7ff-823j",
  "modified": "2025-11-04T00:32:15Z",
  "published": "2025-01-07T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0239"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929156"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-01"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-02"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-04"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-08T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.",
  "id": "GHSA-p53g-mf4j-5xxx",
  "modified": "2024-04-04T00:33:23Z",
  "published": "2022-05-24T16:45:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11550"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/article/CTX247735"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/v1/search?searchQuery=%22%22\u0026lang=en\u0026sort=cr_date_desc\u0026prod=\u0026pver=\u0026ct=Security+Bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T09:17:10Z",
    "severity": "MODERATE"
  },
  "details": "Improper certificate validation in Checkmk \u003c2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other\u0027s mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.",
  "id": "GHSA-p53j-vwhv-xp3w",
  "modified": "2026-09-04T09:31:59Z",
  "published": "2026-09-04T09:31:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15937"
    },
    {
      "type": "WEB",
      "url": "https://checkmk.com/werk/19735"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-18089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-03T14:16:24Z",
    "severity": "HIGH"
  },
  "details": "Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.\n\nverify_xml in Net::SAML2::Role::VerifyXML runs \"return if !$anchors \u0026\u0026 !$cacert;\" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response\u0027s own dsig:KeyInfo/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with \"return $xml unless $cacert;\".\n\nAny caller that constructs Binding::POST or calls Assertion-\u003enew_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion.",
  "id": "GHSA-p5j9-p2w8-q5rw",
  "modified": "2026-08-03T21:31:34Z",
  "published": "2026-08-03T15:32:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18089"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Binding/POST.pm#L21"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Protocol/Assertion.pm#L84"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Role/VerifyXML.pm#L32"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.88/source/Changes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-4948"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-11-14T12:30:00Z",
    "severity": "MODERATE"
  },
  "details": "The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers\u0027 installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.",
  "id": "GHSA-p5m6-f3fp-3v88",
  "modified": "2022-05-17T03:27:30Z",
  "published": "2022-05-17T03:27:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4948"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/87048"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/111708"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/56382"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-sydent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T22:03:44Z",
    "nvd_published_at": "2023-08-04T16:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "## Impact\n\nIf configured to send emails using TLS, Sydent does not verify SMTP servers\u0027 certificates. This makes  Sydent\u0027s emails vulnerable to interception via a [man-in-the-middle (MITM) attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Attackers with privileged access to the network can intercept room invitations and address confirmation emails.\n\nCVSS 3.1 overall score: 3.3 - [AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N\u0026version=3.1)\n\n_Reported by Martin Schobert, [Pentagrid AG](https://pentagrid.ch/)._\n\n### Details\n\nSydent can be configured to send emails over a TLS-encrypted socket by setting\n\n```yaml\nemail:\n    tlsmode: \"TLS\"  # or the legacy value \"SSL\"\n```\n\nin its config file. Alternatively it can be configured to use [Opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) by setting\n\n```yaml\nemail:\n    tlsmode: \"STARTTLS\"\n```\n\nIn both situations, Sydent will encrypt its communication with the SMTP server when sending emails. **In affected versions, Sydent will not verify the destination server\u0027s certificate.**\n\n### Vulnerability \n\nSydent sends email for two purposes:\n- to inform a third party that they have been invited to a Matrix room by their email address; and\n- to verify that a given Matrix user controls an email address.\n\nTherefore, attackers capable of running a MITM attack can\n\n1. Intercept room invitations sent to an email address. The invitation includes \n   - the room ID and its avatar, and\n   - the inviter\u0027s username, displayname and their avatar, and\n   - credentials for a guest Matrix account on the inviter\u0027s homeserver.\n2. Intercept address ownership confirmation emails. This would allow the attacker to falsely claim ownership of the indented recipient\u0027s Matrix account, if that account was permitted to log in using an email address and no other authentication factors.\n\n\n### Patches\n\nThis is patched in [Sydent 2.5.6](https://github.com/matrix-org/sydent/releases/tag/v2.5.6), see PR https://github.com/matrix-org/sydent/pull/574.\n\nWhen patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. If you are using self-signed certificates, make sure to copy your Certification Authority certificate, or your self signed certificate if using only one, to the trust store of your operating system.\n\n### Workarounds\n\nOne can ensure Sydent\u0027s emails fail to send by setting the configured SMTP server to a loopback or [non-routable](https://datatracker.ietf.org/doc/html/rfc1918#section-3) address under your control which does not have a listening SMTP server. For example:\n\n```yaml\nemail:\n    smtphost: \"localhost\"  # Assuming there is no SMTP server listening on localhost\n```\n\n### References\n\n- https://github.com/matrix-org/sydent/pull/574 implements the fix.\n- https://github.com/matrix-org/sydent/releases/tag/v2.5.6 is the release including this fix.\n- https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations details the best-practice advice on how to use the standard library `smtp` module safely.\n- https://peps.python.org/pep-0476/ (accepted) proposed enabling TLS certificate verification by default  in standard library HTTP clients.\n- https://github.com/python/cpython/issues/91826 discusses enabling TLS certificate verification by default in the Python standard library, for SMTP and other protocols.\n\n## For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).",
  "id": "GHSA-p6hw-wm59-3g5g",
  "modified": "2023-08-04T18:41:16Z",
  "published": "2023-07-31T22:03:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/issues/91826"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/pull/574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/sydent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml"
    },
    {
      "type": "WEB",
      "url": "https://peps.python.org/pep-0476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sydent does not verify email server certificates"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-2902"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-21T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.",
  "id": "GHSA-p6m7-449x-fvm9",
  "modified": "2024-04-03T23:59:19Z",
  "published": "2022-05-17T19:57:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2902"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792646"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-2902"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/04/18/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "twitter-stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-24392"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-19T19:21:49Z",
    "nvd_published_at": "2021-02-19T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).",
  "id": "GHSA-p6p8-q4pj-f74m",
  "modified": "2021-03-19T19:21:49Z",
  "published": "2021-03-29T16:28:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24392"
    },
    {
      "type": "WEB",
      "url": "https://github.com/voloko/twitter-stream"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2020-097-voloko-twitter-stream"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Certificate Validation in twitter-stream"
}