CVE-2021-34433CWE-322

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without…

published August 20, 2021

CVSS
—
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weakness
CWE-322 · Key Exchange without Entity Authentication
Published
2021-08-20T17:10Z
EPSS history
Timeline
  • 20 AUG 17:10Z
    In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without…
    cvelistv5