axis-java-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "robert lazarski (JIRA)" <>
Subject [jira] [Commented] (AXIS-2905) Insecure certificate validation CVE-2014-3596
Date Fri, 03 May 2019 15:40:00 GMT


robert lazarski commented on AXIS-2905:

Thanks for looking into this ... the file referenced in the patch has not been updated since
2002! Some of it uses internal com.sun classes. 

There is a couple of LDAP import in the patch, I couldn't easily figure out a smaller jar
to use so for now this entry into the axis-rt-core pom.xml will do:


When compiling on Linux with jdk1.8.0_181 and the latest maven 3.6.1 with -X (debug mode)
I ran into this error, that's as far as I have time on this, I don't run axis 1.x myself anymore
- I just help maintain it:

[INFO] --- animal-sniffer-maven-plugin:1.8:check (default) @ axis-rt-core ---
[INFO] Checking unresolved references to org.codehaus.mojo.signature:java14-sun:1.0
[INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 8.488 s
[INFO] Finished at: 2019-05-03T05:38:00-10:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.codehaus.mojo:animal-sniffer-maven-plugin:1.8:check (default)
on project axis-rt-core: Execution default of goal org.codehaus.mojo:animal-sniffer-maven-plugin:1.8:check
failed: Invalid signature file digest for Manifest main attributes -> [Help 1]



> Insecure certificate validation CVE-2014-3596
> ---------------------------------------------
>                 Key: AXIS-2905
>                 URL:
>             Project: Axis
>          Issue Type: Bug
>    Affects Versions: 1.4
>            Reporter: David Jorm
>            Priority: Major
>         Attachments: CVE-2014-3596.patch
> It was found that the fix for CVE-2012-5784 was incomplete. The code added to check that
the server hostname matches the domain name in the subject's CN field was flawed. This can
be exploited by a Man-in-the-middle (MITM) attack where the attacker can spoof a valid certificate
using a specially crafted subject.
> For more details, see:

This message was sent by Atlassian JIRA

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message