MGASA-2014-0548

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0548.html
Import Source
https://advisories.mageia.org/MGASA-2014-0548.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2014-0548
Upstream
  • CVE-2014-0363
  • CVE-2014-5075
Published
2014-12-26T17:04:58Z
Modified
2026-04-16T06:24:30Z
Summary
Updated smack packages fix security vulnerabilities
Details

Updated smack packages fix security vulnerabilities:

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain (CVE-2014-0363).

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate (CVE-2014-5075).

References
Credits

Affected packages

Mageia:4 / smack

Package

Name
smack
Purl
pkg:rpm/mageia/smack?arch=source&distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.2-4.1.mga4

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2014-0548.json"