Description

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.

Remediation

References

CVE-2015-3455

Related Vulnerabilities

Joomla! Core 1.7.x Security Bypass (1.7.0 - 1.7.5)

WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.38)

WordPress Plugin Click to Call or Chat Buttons Cross-Site Scripting (1.4.0)

WordPress Plugin Simple Membership SQL Injection (4.0.3)

Joomla! Core Information Disclosure (2.5.0 - 3.9.22)

Severity

Low

Classification

CVE-2015-3455 CWE-20

Tags

Missing Update Known Vulnerabilities