CVE-2021-34433 is a vulnerability in Eclipse Californium
Published on August 20, 2021
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
Weakness Type
Key Exchange without Entity Authentication
The software performs a key exchange with an actor without verifying the identity of that actor. Performing a key exchange will preserve the integrity of the information sent between two entities, but this will not guarantee that the entities are who they claim they are. This may enable an attacker to impersonate an actor by modifying traffic between the two entities. Typically, this involves a victim client that contacts a malicious server that is impersonating a trusted server. If the client skips authentication or ignores an authentication failure, the malicious server may request authentication information from the user. The malicious server can then use this authentication information to log in to the trusted server using the victim's credentials, sniff traffic between the victim and trusted server, etc.
Products Associated with CVE-2021-34433
Want to know whenever a new CVE is published for Eclipse Californium? stack.watch will email you.
Affected Versions
The Eclipse Foundation Eclipse Californium:- Version 2.0.0 and below unspecified is affected.
- Version unspecified, <= 2.6.4 is affected.
- Version 3.0.0-M1 and below unspecified is affected.
- Version unspecified, <= 3.0.0-M3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.