CVE-2014-3596
CVE-2014-3596 is a medium-severity vulnerability in Apache Axis with a CVSS 2.0 base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.8)
- EPSS exploit prediction: 6% (92nd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Apache Axis
- Published:
- Last modified:
Description
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Frequently asked questions
- What is CVE-2014-3596?
- The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
- How severe is CVE-2014-3596?
- CVE-2014-3596 has a CVSS 2.0 base score of 5.8, rated medium severity.
- Is CVE-2014-3596 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-3596?
- CVE-2014-3596 primarily affects Apache Axis. In total, 19 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-3596?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-3596 published?
- CVE-2014-3596 was published on 2014-08-27 and last updated on 2026-06-17.
References
- http://linux.oracle.com/errata/ELSA-2014-1193.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html
- http://rhn.redhat.com/errata/RHSA-2014-1193.html
- http://secunia.com/advisories/61222
- http://www.openwall.com/lists/oss-security/2014/08/20/2
- http://www.securityfocus.com/bid/69295
- http://www.securitytracker.com/id/1030745
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95377
- https://issues.apache.org/jira/browse/AXIS-2905
- https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2020.html
Affected products (19)
- cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.0:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.1:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:alpha:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:beta3:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2:rc3:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:axis:1.3:*:*:*:*:*:*:*
More vulnerabilities in Apache Axis
- CVE-2023-40743 — Critical (CVSS 9.8): ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that…
- CVE-2019-0227 — High (CVSS 7.5): A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in…
- CVE-2023-51441 — High (CVSS 7.2): ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the…
- CVE-2018-8032 — Medium (CVSS 6.1): Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default…
- CVE-2012-5784 — Medium (CVSS 5.8): Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP,…
- CVE-2007-2353 — Medium (CVSS 5.0): Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which…