CVE-2015-3455
No CVSS score yet. EPSS 11% chance of exploitation in the next 30 days.
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.
- EPSS
- 11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- oracle:linux
- oracle:solaris
- squid-cache:squid
References
- http://advisories.mageia.org/MGASA-2015-0191.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00016.html
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
- http://rhn.redhat.com/errata/RHSA-2015-2378.html