CVE-2016-0818

The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x…

published March 12, 2016

CVSS
—
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Published
2016-03-12T21:00Z
EPSS history
Timeline
  • 12 MAR 21:00Z
    The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x…
    cvelistv5