CVE-2003-1229

Oracle Jre < 1.4.1 - Improper Certificate Validation

Title source: rule

Description

X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.

References (11)

Scores

EPSS 0.0129
EPSS Percentile 79.4%

Classification

CWE
CWE-295
Status draft

Affected Products (3)

oracle/jre < 1.4.1
sun/java_web_start < 1.2
sun/jsse

Timeline

Published Dec 31, 2003
Tracked Since Feb 18, 2026