CVE-2014-3495

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

duplicity 0.6.24 has improper verification of SSL certificates

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
duplicity	duplicity	0.6.24

References

https://access.redhat.com/security/cve/cve-2014-3495Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3495Exploit, Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-3495Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-3495Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-3495Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3495Exploit, Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-3495Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-3495Third Party Advisory

Timeline

Published: Dec 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-349610.0cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via she CVE-2014-34974.3Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or CVE-2014-34988.8The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.CVE-2014-34997.2Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via un CVE-2014-35006.4Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.CVE-2014-35014.3Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScrip CVE-2014-35024.3Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI sch CVE-2014-35035.0Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the pas CVE-2014-35044.0The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.CVE-2014-35055.0Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0 CVE-2014-35065.0d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers t CVE-2014-35075.0Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows rem