CVE-2007-6591
KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields…
Does this matter?
Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.
Description
KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 0.82% probability · 55th percentile
- CISA KEV
- Not listed
- Affected
- kde/konqueror
- Source
- cve@mitre.org
References
- http://nils.toedtmann.net/pub/subjectAltName.txt
- http://securityreason.com/securityalert/3498
- http://www.securityfocus.com/archive/1/483929/100/100/threaded
- http://www.securityfocus.com/archive/1/483937/100/100/threaded
- http://www.securityfocus.com/archive/1/483960/100/100/threaded
- http://nils.toedtmann.net/pub/subjectAltName.txt
- http://securityreason.com/securityalert/3498
- http://www.securityfocus.com/archive/1/483929/100/100/threaded
- http://www.securityfocus.com/archive/1/483937/100/100/threaded
- http://www.securityfocus.com/archive/1/483960/100/100/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.