HIGH🇵🇱 Wersja polska

CVE-2021-34433

CVSS 7.5v3.1pub. 2021-08-20upd. 2024-11-21

In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Eclipse Californium

    APP
    Eclipse
    3.0.02.0.0 – 2.6.5 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-39368HIGH8.2same product

Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud servi...

CVE-2022-2576HIGH7.5same product

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS...

CVE-2020-27222HIGH7.5same product

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidental...

CVE-2026-12605CRITICAL9.6PL ✓same vendor

Eclipse GlassFish: CSRF+SSRF w DownloadServlet umożliwia przejęcie domeny

CVE-2026-60007CRITICAL9.1PL ✓same vendor

Eclipse Milo: padding oracle w uwierzytelnianiu OPC-UA umożliwia odzyskanie hasła