Homepage About Snyk

Signature Validation Bypass Affecting org.eclipse.californium:scandium Open this link in a new tab package, versions [2.0.0,2.6.5) [3.0.0-M1,3.0.0-M4)

0.0
medium

  • Attack Complexity

    High

  • Confidentiality

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-ORGECLIPSECALIFORNIUM-1568503

  • published

    22 Aug 2021

  • disclosed

    22 Aug 2021

  • credit

    Achim Kraus

Report a new vulnerability Found a mistake?

Introduced: 22 Aug 2021

CVE-2021-34433 Open this link in a new tab
CWE-322 Open this link in a new tab

How to fix?

Upgrade org.eclipse.californium:scandium to version 2.6.5, 3.0.0-M4 or higher.

Overview

org.eclipse.californium:scandium is a library for exchanging data using DTLS over UDP.

Affected versions of this package are vulnerable to Signature Validation Bypass. If the signature is not included in ServerKeyExchange, then the certificate based (x509 and RPK) DTLS handshakes succeeds without verifying the server side's signature on the client side.