CVE-2014-3504 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2014-3504 Interim 1 46 2024-10-31T03:22:41Z current 2021-05-30T13:20:58Z 2024-10-31T03:22:41Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2014-3504 The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 openSUSE Leap 15.2 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed libserf libserf-1-1 libserf-1-1-1.3.7-1.37 libserf-1-1-1.3.7-1.8 libserf-1-1-1.3.7-3.3.1 libserf-1-1-1.3.9-1.2 libserf-1-1-1.3.9-150600.16.2 libserf-1-1-1.3.9-2.31 libserf-1-1-1.3.9-lp152.4.8 libserf-devel-1.3.9-1.2 libserf-devel-1.3.9-150600.16.2 libserf-devel-1.3.9-2.31 libserf-1-1-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 libserf-devel-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 libserf-1-1-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 libserf-devel-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 libserf-1-1-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libserf-devel-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libserf-1-1-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libserf-devel-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libserf-1-1-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libserf-devel-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libserf-1-1-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 libserf-devel-1.3.9-2.31 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 libserf-1-1-1.3.9-150600.16.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 libserf-devel-1.3.9-150600.16.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 libserf-1-1-1.3.7-1.37 as a component of SUSE Linux Enterprise Software Development Kit 12 libserf-1-1-1.3.7-1.37 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libserf-1-1-1.3.7-1.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libserf-1-1-1.3.7-1.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libserf-1-1-1.3.7-1.8 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libserf-1-1-1.3.7-3.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libserf-1-1-1.3.7-3.3.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libserf-1-1-1.3.9-lp152.4.8 as a component of openSUSE Leap 15.2 libserf-1-1-1.3.9-2.31 as a component of openSUSE Leap 15.3 libserf-1-1-1.3.9-2.31 as a component of openSUSE Leap 15.4 libserf-1-1-1.3.9-1.2 as a component of openSUSE Tumbleweed libserf-devel-1.3.9-1.2 as a component of openSUSE Tumbleweed libserf-1-1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libserf as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. CVE-2014-3504 SUSE Linux Enterprise Module for Basesystem 15:libserf-1-1-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15:libserf-devel-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP1:libserf-1-1-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP1:libserf-devel-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP2:libserf-1-1-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP2:libserf-devel-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP3:libserf-1-1-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP3:libserf-devel-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP4:libserf-1-1-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP4:libserf-devel-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP5:libserf-1-1-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP5:libserf-devel-1.3.9-2.31 SUSE Linux Enterprise Module for Basesystem 15 SP6:libserf-1-1-1.3.9-150600.16.2 SUSE Linux Enterprise Module for Basesystem 15 SP6:libserf-devel-1.3.9-150600.16.2 SUSE Linux Enterprise Software Development Kit 12:libserf-1-1-1.3.7-1.37 SUSE Linux Enterprise Software Development Kit 12 SP1:libserf-1-1-1.3.7-1.37 SUSE Linux Enterprise Software Development Kit 12 SP2:libserf-1-1-1.3.7-1.8 SUSE Linux Enterprise Software Development Kit 12 SP3:libserf-1-1-1.3.7-1.8 SUSE Linux Enterprise Software Development Kit 12 SP4:libserf-1-1-1.3.7-1.8 SUSE Linux Enterprise Software Development Kit 12 SP5:libserf-1-1-1.3.7-3.3.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libserf-1-1-1.3.7-3.3.1 openSUSE Leap 15.2:libserf-1-1-1.3.9-lp152.4.8 openSUSE Leap 15.3:libserf-1-1-1.3.9-2.31 openSUSE Leap 15.4:libserf-1-1-1.3.9-2.31 openSUSE Tumbleweed:libserf-1-1-1.3.9-1.2 openSUSE Tumbleweed:libserf-devel-1.3.9-1.2 SUSE Linux Enterprise Workstation Extension 12 SP5:libserf SUSE Linux Enterprise Workstation Extension 12 SP5:libserf-1-1 low 4 AV:N/AC:H/Au:N/C:P/I:P/A:N