CVE-2013-4248 in PHP
요약 (영어)
The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a \0 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
예약하다
2013. 06. 12.
공개
2013. 08. 17.
상태
확인됨
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 9971 | PHP SSL Module 권한 상승 | 20 | 개념 증명 | 공식 수정 | CVE-2013-4248 |