CVE-2011-5238

google-checkout-php < 1.3.2 - Man-in-the-Middle Attack via SSL Certificate Spoofing

Title source: llm

Description

google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (2)

Core 2

Core References

Various Sources x_refsource_misc

http://www.unrest.ca/peerjacking

Patch x_refsource_confirm

https://code.google.com/p/google-checkout-php-sample-code/downloads/detail?name=checkout-php-1.3.2.zip

Scores

EPSS 0.0038

EPSS Percentile 29.9%

Details

CWE

CWE-20

Status published

Products (6)

google/checkout-php 1.2 (2 CPE variants)

google/checkout-php 1.2.1 beta

google/checkout-php 1.2.5

google/checkout-php 1.2.5a

google/checkout-php 1.3.0

google/checkout-php < 1.3.1

Published Nov 06, 2012

Tracked Since Feb 18, 2026