CVE-2021-34433

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-322CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-344345.3In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a CVE-2021-344358.8In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the CVE-2021-344369.8In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extCVE-2021-344387.8Windows Font Driver Host Remote Code Execution VulnerabilityCVE-2021-344397.8Microsoft Windows Media Foundation Remote Code Execution VulnerabilityCVE-2021-34447.8The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be CVE-2021-344405.5GDI+ Information Disclosure VulnerabilityCVE-2021-344417.8Microsoft Windows Media Foundation Remote Code Execution VulnerabilityCVE-2021-344428.8Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-344446.5Windows DNS Server Denial of Service VulnerabilityCVE-2021-344457.8Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityCVE-2021-344468.0Windows HTML Platforms Security Feature Bypass Vulnerability