Christian Heimes

2 exploits Active since Mar 2018
CVE-2018-8970 NOMISEC HIGH WORKING POC
LibreSSL 2.7.0 - Improper Certificate Validation via Zero-Length Hostname
The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not.
1 stars
CVSS 7.4
CVE-2024-5642 WRITEUP MEDIUM WRITEUP
CPython < 3.9.24 and 3.10.0a1-3.10.0b1 - Buffer Over-read via SSLContext.set_npn_protocols()
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
CVSS 6.5