CVE-2014-2903

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/62604Permissions Required, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/04/18/2Mailing List, Third Party Advisory
http://secunia.com/advisories/62604Permissions Required, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/04/18/2Mailing List, Third Party Advisory

Timeline

Published: Oct 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-29047.5wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.CVE-2014-29056.9fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the unive CVE-2014-29067.0The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute CVE-2014-29074.3The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly updat CVE-2014-29084.3Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attac CVE-2014-29095.8CRLF injection vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inje CVE-2014-29137.5Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arb CVE-2014-29149.8fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attack CVE-2014-29155.5Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a de CVE-2014-29166.8Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers CVE-2014-29217.5The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handl CVE-2014-29226.4The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handl