CVE-2017-8445

MEDIUM Year: 2017
CVSS v3 Score
5.5
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-295
View all →

Vulnerability Description

An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replaced with an instance that trusts all certificates. This could allow any node using any certificate to join a cluster. The proper behavior in this instance is for the TLS trust manager to deny all certificates.

Related Vulnerabilities

CVE-2012-1096

MEDIUM
CVSS:5.5(Medium)

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection.

CWE-2952012

CVE-2018-8356

MEDIUM
CVSS:5.5(Medium)

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects...

CWE-2952018

CVE-2019-14334

MEDIUM
CVSS:5.5(Medium)

An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert...

CWE-2952019

CVE-2021-26320

MEDIUM
CVSS:5.5(Medium)

Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP

CWE-2952021

CVE-2022-22946

MEDIUM
CVSS:5.5(Medium)

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager....

CWE-2952022

CVE-2022-26766

MEDIUM
CVSS:5.5(Medium)

A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS ...

CWE-2952022