CVE-2017-1000415 — MEDIUM (5.9)

Vulnerability Description

MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.

CVSS Score

5.9

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Matrixssl	Matrixssl	3.7.2

Related Weaknesses (CWE)

CWE-295

References

https://www.ieee-security.org/TC/SP2017/papers/231.pdfThird Party Advisory
https://www.youtube.com/watch?v=FW--c_F_cY8Third Party Advisory
https://www.ieee-security.org/TC/SP2017/papers/231.pdfThird Party Advisory
https://www.youtube.com/watch?v=FW--c_F_cY8Third Party Advisory

FAQ

What is CVE-2017-1000415?

CVE-2017-1000415 is a vulnerability with a CVSS score of 5.9 (MEDIUM). MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delay...

How severe is CVE-2017-1000415?

CVE-2017-1000415 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-1000415?

Check the references section above for vendor advisories and patch information. Affected products include: Matrixssl Matrixssl.