VulnerabilityModified
CVE-2017-1000415
MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.
MEDIUM 5.9EPSS 0.48%
Does this matter?
Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.
Description
MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.
- CVSS 3.0
- 5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- matrixssl/matrixssl
- Source
- cve@mitre.org
References
- https://www.ieee-security.org/TC/SP2017/papers/231.pdfThird Party Advisory
- https://www.youtube.com/watch?v=FW--c_F_cY8Third Party Advisory
- https://www.ieee-security.org/TC/SP2017/papers/231.pdfThird Party Advisory
- https://www.youtube.com/watch?v=FW--c_F_cY8Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.