| Detector: | Tikanga |
| Target: | project ' axis1 ' version1.2 |
| Misuse: | misuse ' SV_CVE_12_5784_2 ' |
| Tags: |
Details about the known misuse from the MUBench dataset.
| Description: | Apache Axis did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. |
| Fix Description: | (see diff) |
| Violations: |
|
| In File: | org/apache/axis/components/net/JSSESocketFactory.java |
| In Method: | verifyHostName(String, SSLSocket) |
| Code with Misuse: |
|
