PT-2015-6380
CVE-2015-3996
·
تاريخ النشر
2015-10-27
·
تاريخ التحديث
2015-10-28
الوصف من
CVSS 2.0
4.3
متوسطةالمقاييسAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
AFNetworking framework versions prior to 2.5.3
Description
The issue concerns the default configuration of AFSecurityPolicy.validatesDomainName for AFSSLPinningModeNone in the AFNetworking framework. This configuration disables the verification of a server's hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate. As a result, it allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Recommendations
For AFNetworking framework versions prior to 2.5.3, update to version 2.5.3 or later to enable the verification of a server's hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾