CVE-2012-4523

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-09-13T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-01-29T10:00:00.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "[radsecproxy] 20120917 Radsecproxy 1.6.1 is out", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html"}, {"name": "56105", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/56105"}, {"name": "51251", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/51251"}, {"name": "[oss-security] 20121031 Re: Re: CVE request: radsecproxy incorrect x.509 certificate validation", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/10/31/6"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://project.nordu.net/browse/RADSECPROXY-43"}, {"name": "DSA-2573", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2012/dsa-2573"}, {"name": "[radsecproxy] 20120913 Radsecproxy is mixing up pre- and post-TLS-handshake client verification", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html"}, {"name": "[oss-security] 20121017 CVE request: radsecproxy incorrect x.509 certificate validation", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/10/17/7"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2012-4523", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[radsecproxy] 20120917 Radsecproxy 1.6.1 is out", "refsource": "MLIST", "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html"}, {"name": "56105", "refsource": "BID", "url": "http://www.securityfocus.com/bid/56105"}, {"name": "51251", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/51251"}, {"name": "[oss-security] 20121031 Re: Re: CVE request: radsecproxy incorrect x.509 certificate validation", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/10/31/6"}, {"name": "https://project.nordu.net/browse/RADSECPROXY-43", "refsource": "CONFIRM", "url": "https://project.nordu.net/browse/RADSECPROXY-43"}, {"name": "DSA-2573", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2573"}, {"name": "[radsecproxy] 20120913 Radsecproxy is mixing up pre- and post-TLS-handshake client verification", "refsource": "MLIST", "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html"}, {"name": "[oss-security] 20121017 CVE request: radsecproxy incorrect x.509 certificate validation", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/10/17/7"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T20:42:54.583Z"}, "title": "CVE Program Container", "references": [{"name": "[radsecproxy] 20120917 Radsecproxy 1.6.1 is out", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html"}, {"name": "56105", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/56105"}, {"name": "51251", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/51251"}, {"name": "[oss-security] 20121031 Re: Re: CVE request: radsecproxy incorrect x.509 certificate validation", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/10/31/6"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://project.nordu.net/browse/RADSECPROXY-43"}, {"name": "DSA-2573", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2012/dsa-2573"}, {"name": "[radsecproxy] 20120913 Radsecproxy is mixing up pre- and post-TLS-handshake client verification", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html"}, {"name": "[oss-security] 20121017 CVE request: radsecproxy incorrect x.509 certificate validation", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/10/17/7"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-4523", "datePublished": "2012-11-20T00:00:00.000Z", "dateReserved": "2012-08-21T00:00:00.000Z", "dateUpdated": "2024-08-06T20:42:54.583Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uninett:radsecproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "E584E72B-9896-445A-A13B-7846418AB30C", "versionEndIncluding": "1.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "C4CBC2D4-9F6A-45BE-B140-8352A3BC39DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.0:alpha:*:*:*:*:*:*", "matchCriteriaId": "C16B610A-1827-4C4E-828E-14E7941E8670", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.0:alpha-p1:*:*:*:*:*:*", "matchCriteriaId": "DFAFCCC6-D0EE-4B7A-8DF2-315B36B1FF81", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.0:p1:*:*:*:*:*:*", "matchCriteriaId": "EC0A8D36-6EC2-419F-B3C8-6642FE16A8DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "DDA9FD53-D9FE-43BF-B387-4098770192A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.1:alpha:*:*:*:*:*:*", "matchCriteriaId": "624FD1B7-C746-4C40-9690-0406298ABBD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.1:beta:*:*:*:*:*:*", "matchCriteriaId": "CE4446A8-E7FD-4138-9576-F96E7D9D6947", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.2:*:*:*:*:*:*:*", "matchCriteriaId": "1ED032C3-4C5F-4F15-81BD-0C252F8C1CE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.3:alpha:*:*:*:*:*:*", "matchCriteriaId": "9B2E1ACF-81C6-4829-9027-144E87CF78D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.3:beta:*:*:*:*:*:*", "matchCriteriaId": "A216CB0E-C26B-4BDE-9EEE-0608CADB8D93", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "6707C32A-F4ED-458C-A4FA-5AAAB3CD6725", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.4:*:*:*:*:*:*:*", "matchCriteriaId": "B7610379-66F9-4F1F-B49E-36E8463CFE44", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "E5D6012D-16D2-46D3-B611-CE792B9C1194", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "CD5B48A8-25E5-4628-B0B7-21DE24E2458D", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "E63FF14F-C923-4375-98A6-C630F886562A", "vulnerable": true}, {"criteria": "cpe:2.3:a:uninett:radsecproxy:1.5:*:*:*:*:*:*:*", "matchCriteriaId": "D71552E9-B6A1-4772-8D91-5AD0BCD8BF9B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients."}, {"lang": "es", "value": "radsecproxy antes de v1.6.1 no verifica correctamente certificados cuando hay bloques de configuraci\u00f3n con la configuraci\u00f3n de CA que no est\u00e1n relacionados con el bloque que est\u00e1 siendo utilizado para comprobar la cadena de certificados, lo que podr\u00eda permitir a atacantes remotos evitar las restricciones de acceso previstas y suplantar clientes."}], "id": "CVE-2012-4523", "lastModified": "2026-06-16T23:45:15.370", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-11-20T00:55:01.117", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/51251"}, {"source": "secalert@redhat.com", "url": "http://www.debian.org/security/2012/dsa-2573"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/10/17/7"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/10/31/6"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/56105"}, {"source": "secalert@redhat.com", "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html"}, {"source": "secalert@redhat.com", "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html"}, {"source": "secalert@redhat.com", "url": "https://project.nordu.net/browse/RADSECPROXY-43"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/51251"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2012/dsa-2573"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/10/17/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/10/31/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/56105"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://project.nordu.net/browse/RADSECPROXY-43"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}